Quick answer

Report abusive collection by an online lending app to the Securities and Exchange Commission (SEC) through the SEC iMessage portal. Report unauthorized access to contacts, debt-shaming, unlawful disclosure, excessive app permissions, or other misuse of personal data to the National Privacy Commission (NPC) through its formal complaint process. If there are credible threats, extortion, fraud, impersonation, account hacking, or immediate danger, also report promptly to the PNP, NBI, or DICT cyber channels listed in the government’s 18 March 2026 advisory on online lending platforms.

Preserve the evidence before uninstalling the app or blocking every number. Reporting harassment does not automatically erase a valid loan, but owing money does not authorize threats, public shaming, deception, or unlawful use of personal data.

Which agency should receive the report?

Problem	Where to report
Threats, insults, deceptive collection, public shaming, prohibited contact with third parties, or other unfair collection by a lending or financing company	SEC iMessage, selecting the service for the Financing and Lending Companies Department or FINLEND
Unauthorized or excessive access to contacts, photos, messages, location, or other data; disclosure of the debt; use of personal data to harass	National Privacy Commission
Credible threats of violence, extortion, fraud, hacking, identity misuse, fake police or court documents, or other possible crimes	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline
Loan issued by a bank, digital bank, e-wallet provider, or another BSP-supervised institution	Complain first to the institution, then use the BSP Consumer Assistance Mechanism if unresolved
Loan issued by a cooperative	Cooperative Development Authority, while privacy violations may still be reported to the NPC

The app’s brand name may differ from the legal name of the company operating it. Check the loan agreement, disclosure statement, privacy notice, app-store developer page, payment instructions, and collection messages to identify the actual lender and any collection agency.

What conduct may be reported?

Unfair debt collection

Under SEC Memorandum Circular No. 18, series of 2019, lending companies, financing companies, and their third-party collectors may use reasonable and lawful means to collect. They may not use methods such as:

Violence or threats of violence or other criminal acts against a person, reputation, or property.
Threats to take action that cannot legally be taken.
Obscenities, insults, or profane language that abuse the borrower or amount to an offense.
Publication or disclosure of a borrower’s identity and personal information outside recognized lawful circumstances.
Communicating loan information known, or which should be known, to be false—including failing to say that a debt is disputed when communicating it.
False representations or deceptive means to collect a debt or obtain information.
Contact before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly consented, through written, electronic, or recorded means, that those hours are the only reasonable or convenient opportunity for contact.
Contacting people in the borrower’s contact list who were not named as guarantors.

The exceptions concerning contact hours do not permit threats, insults, deception, or public shaming.

The lender remains responsible for collection work it outsources. The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, also prohibits abusive collection and makes a regulated provider responsible for its representatives and solidarily liable with accredited third-party service providers for covered acts or omissions, including debt collection.

Contact-list abuse and debt-shaming

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

Unconstrained, excessive, or disproportionate processing of a borrower’s contact list is prohibited.
An app may receive only the limited access necessary to let a borrower select a character reference or guarantor, or to derive proportional metadata where necessary for a specified and legitimate purpose.
Contact-list processing that leads to harassment, collection from persons other than guarantors, or unfair collection is prohibited.
A character reference may be contacted to verify the borrower’s identity and the truth of information supplied during the application. A character reference is not automatically a guarantor and may not be used for debt collection, marketing, or cross-selling.
A guarantor must have separately and expressly consented to undertake the obligation. For debt collection, the lender may contact the guarantor—not unrelated family members, friends, co-workers, or other phone contacts.
Camera or photo-gallery access may be allowed for a legitimate purpose such as identity, know-your-customer, fraud-prevention, or payment verification. It must not be used to embarrass the borrower, and access should end or be revocable once the purpose has been completed.
The app may not demand unnecessary permissions or retain personal data indefinitely without a lawful and continuing purpose.

Tapping “Allow” does not give the app unlimited authority. Personal-data processing must still be transparent, for a legitimate purpose, and proportionate under the Data Privacy Act of 2012.

Lawful disclosures are limited

Not every disclosure connected with collection is automatically illegal. SEC rules recognize limited circumstances such as disclosure with the borrower’s written or recorded consent, disclosure required by a court or authorized government agency, authorized credit-information exchanges, or necessary disclosure to a collection agency, counsel, insurer, or service provider for a legitimate purpose.

These exceptions do not authorize posting the borrower’s photograph on social media, announcing the debt to an employer or group chat, messaging unrelated contacts to shame the borrower, or using personal information for threats.

What to do immediately

1. Preserve the evidence

Before deleting the app, changing phones, or blocking all communications, save:

Screenshots showing the complete message, sender, date, time, phone number, username, URL, and platform.
Screen recordings of disappearing posts or in-app messages, where lawful.
Call logs, voicemails, emails, chat exports, and notification history.
The app-store listing, developer name, app version, permissions page, privacy notice, and terms presented when you applied.
The loan agreement, promissory note, disclosure statement, repayment schedule, receipts, payment records, and account ledger.
Collection notices, names claimed by collectors, callback numbers, payment accounts, and any fake-looking court, police, or lawyer documents.
Messages received by relatives, friends, employers, or co-workers. Ask each recipient to preserve the original message and prepare a dated account of what happened.
Proof of harm, where relevant: takedown requests, employment correspondence, medical records, counseling expenses, lost-income records, or other documented consequences.
A chronological incident log stating who contacted whom, what was said or disclosed, and when it happened.

Keep original, unedited copies. Back them up to a secure location. Do not publicly repost other people’s phone numbers, IDs, or private messages merely to expose the collector.

Avoid secretly recording private calls without legal advice. Republic Act No. 4200 generally prohibits secretly recording a private communication without authorization from all parties. Preserve voicemails and written communications instead, or ask counsel how to document a live call lawfully.

2. Identify the responsible entities

Record both the app name and the legal company name. Look for:

SEC registration number and Certificate of Authority information.
Corporate name and address in the contract or disclosure statement.
Name of the collection agency or third-party service provider.
Privacy or Data Protection Officer contact details.
App-store developer and support information.
Recipient name appearing in payment channels and receipts.

A company’s SEC registration alone does not necessarily mean it has authority to operate as a lending or financing company. You may check the company through Check with SEC and review the SEC’s published lending and financing company information. If you cannot identify the operator, submit the app link, screenshots, phone numbers, payment accounts, email addresses, and every available identifier.

3. Send a written complaint to the lender

Use the lender’s official customer-assistance or Data Protection Officer channel. Republic Act No. 11765 requires regulated financial service providers to maintain a free consumer-assistance mechanism.

State:

Your name and loan or account reference.
The app and legal company involved.
A short, dated chronology.
The exact communications or disclosures being challenged.
Which contacts received messages and whether they were guarantors.
What app permissions and personal data were used.
Whether the debt, amount, fees, or payment history is disputed.
The action you want taken.

Depending on the facts, request that the company:

Stop contacting anyone who is not a valid guarantor.
Stop threats, insults, deceptive statements, and publication.
Remove unlawful posts and notify recipients of any correction or retraction.
Identify the collector and collection agency.
Explain the source, purpose, recipients, and retention period of your personal data.
Correct inaccurate loan or personal information.
Block, remove, or securely destroy data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary, subject to lawful retention requirements.
Preserve relevant logs and records for the regulatory investigation.
Provide a written final response.

Send the complaint in a way that proves receipt, such as an acknowledged email, portal ticket, registered mail, or courier. Keep the ticket number, delivery record, and response.

How to file with the SEC

Use the SEC iMessage portal. The March 2026 joint government advisory specifically directs complaints about unfair collection to SEC FINLEND and lists the SEC hotline as 1-4732 (1-4SEC).

Your submission should include:

The legal name of the lending or financing company, not only the app name.
The app name, download link, developer, and collection agency, if known.
Your contact details and a valid government-issued ID, submitted only through the official channel.
The loan date, amount received, amount demanded, due date, and account reference.
A clear chronology of the harassment.
The specific numbers, accounts, and identities used by collectors.
Copies of the contract, disclosure statement, receipts, messages, call logs, posts, and third-party witness evidence.
The relief requested, such as investigation, cessation of unfair collection, correction of records, or appropriate regulatory action.

SEC guidance calls for a complete complaint supported by evidence and generally requires one complaint form per respondent company. Under the SEC’s published FINLEND procedure, the respondent is ordinarily given 10 days from receipt to submit an answer or comment. The SEC may seek a reply, close a resolved complaint, endorse issues to another agency, or commence administrative action if sufficient grounds exist.

The SEC may impose regulatory sanctions, but an ordinary SEC complaint does not automatically:

Cancel or settle the loan.
Rewrite its payment terms.
Declare the contract void.
Decide that interest is legally unconscionable in every case.

A request for payment or reimbursement is different from a regulatory report. Under Republic Act No. 11765, the SEC may adjudicate a purely civil financial-transaction claim when the only relief sought is payment or reimbursement not exceeding ₱10 million. Procedure and jurisdiction can be technical, so legal advice is sensible if you are seeking a substantial monetary award.

How to file a privacy complaint with the NPC

First send written notice to the company

The 2021 NPC Rules of Procedure normally require exhaustion of remedies. You must inform the lender, collection agency, or other responsible entity in writing about the privacy violation and allow it to act.

You may file after the company fails to take timely or appropriate action, or gives no response within 15 calendar days from receipt of your written notice. Attach proof of receipt and any response.

The NPC may waive this requirement for good cause or a serious violation, including situations involving grave and irreparable harm, lack of a plain and adequate remedy from the respondent, or patently illegal conduct. Explain and prove why a waiver is necessary; it is not automatic.

Prepare the formal complaint

Use the NPC’s complaint-assisted form and filing instructions. The complaint must generally be notarized or otherwise properly verified and should include:

Your identity and contact information.
The respondent’s identity and service details, if known.
A detailed statement of material facts.
The acts or omissions alleged to violate the Data Privacy Act or NPC issuances.
Documentary evidence and witness affidavits, where available.
All relevant correspondence with the respondent.
Proof that you completed the written-notice step, or facts supporting a waiver.
The relief requested.
A certification against forum shopping.
A special power of attorney if someone files as your representative.

The NPC accepts complaints personally, by registered mail, courier, or authorized electronic mail. Follow the current instructions on the filing page concerning notarization, PDF format, digital signatures, copies, and payment.

Under the current NPC schedule of fees, the basic complaint filing fee is ₱500, with applicable legal-research and additional damage-claim fees. Qualified indigent litigants may be exempt. The schedule requires, among other things, family gross income not exceeding twice the applicable monthly minimum wage and no real property with a current tax-declaration value above ₱300,000, supported by the listed certificates and affidavits.

The investigating officer generally has 30 calendar days from receipt to give the complaint due course or dismiss it without prejudice. A complaint may be dismissed for defective form, insufficient evidence, failure to give the respondent an opportunity to act, lack of a privacy issue, or inability to identify or trace the parties despite diligent effort.

Urgent request to stop data processing

After filing a complaint, a complainant may move for a temporary ban on the respondent’s processing of personal data. This is an exceptional remedy requiring supporting facts, a summary hearing, and ordinarily a bond fixed under the rules. Filing the motion suspends the main complaint proceedings while the application is resolved.

Seek legal assistance before using this remedy, especially if the app is continuing to publish data, contact large numbers of people, or use information in a way that creates grave and irreparable harm.

Reporting threats, fraud, or other possible crimes

Do not wait for an SEC or NPC case if there is immediate danger, extortion, stalking, hacking, identity misuse, or a credible threat of violence. Contact emergency services or the nearest police station and report through the channels in the 2026 DICT-NPC-SEC advisory:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Provide the original electronic evidence, device information, links, accounts, phone numbers, payment instructions, and a factual chronology. Ask for the complaint or reference number.

Report quickly because online content and account information can disappear. Under the Cybercrime Prevention Act, law-enforcement authorities have formal mechanisms for preservation and disclosure of computer data, but those mechanisms generally require an officially docketed investigation and, for disclosure, the required court warrant. A personal request to a platform is not a substitute for formal law-enforcement preservation.

Protect your phone and accounts after preserving evidence

Once the necessary evidence is secured:

Revoke unnecessary contact, camera, microphone, storage, photo, and location permissions.
Change passwords that were reused elsewhere and enable multi-factor authentication.
Review email, social-media, cloud, and e-wallet sessions for unfamiliar devices.
Warn affected contacts not to click links, send money, disclose information, or engage with collectors.
Report abusive accounts and posts to the platform after saving the URLs and original evidence.
Ask contacts to preserve their own copies before deleting or blocking messages.
Verify payment instructions through the lender’s official customer-service channel. Do not send payment to an unexplained personal account merely because a collector is threatening you.
Keep legitimate loan payments documented. If you dispute the amount, say so clearly in writing and request a breakdown.

Common mistakes to avoid

Uninstalling the app before recording its identity, permissions, documents, and messages.
Naming only the app. Identify the corporate lender and collection agency whenever possible.
Sending only cropped screenshots. Preserve the sender, timestamp, URL, and surrounding context.
Filing an NPC complaint without proof of written notice and the 15-day response period, unless a properly supported waiver applies.
Omitting notarization, verification, witness affidavits, or certification against forum shopping from an NPC complaint.
Posting the collector’s private information in retaliation. This may expose you to a separate complaint.
Secretly recording calls without checking Republic Act No. 4200.
Sharing passwords, PINs, one-time passwords, full account credentials, or unnecessary IDs. Regulators do not need your password or OTP.
Assuming an app-store report is a government complaint. Platform reporting may remove content or an app, but it does not replace SEC, NPC, or law-enforcement reporting.
Assuming harassment automatically cancels the debt. Collection misconduct and the validity or amount of the loan are separate questions.
Ignoring real court documents. Verify any summons directly with the named court; do not rely on the collector’s phone number.

When legal help is urgent

Consult a Philippine lawyer promptly when:

A collector threatens physical harm, visits your home or workplace aggressively, or appears to know your real-time location.
Intimate images, altered photographs, identity documents, or children’s information are involved.
Your accounts were hacked or unauthorized financial transactions occurred.
You received an authentic subpoena, summons, prosecutor’s notice, warrant, or court order.
You want damages, an injunction, a temporary processing ban, or other urgent relief.
The lender disputes who operated the app or the responsible company is overseas or unregistered.
The amount is substantial, several agencies or cases are involved, or a limitation period may be approaching.

Claims under Republic Act No. 11765 generally prescribe five years from consummation of the financial transaction or five years from discovery of deceit or nondisclosure of material facts, with an absolute limit of ten years from the violation. Other privacy, civil, administrative, and criminal remedies may have different periods. Preserve evidence and obtain advice instead of waiting for the longest possible deadline.

Frequently asked questions

Can the app contact my family, friends, or employer?

For debt collection, an online lender may contact a person who separately and expressly agreed to be a guarantor. A character reference is not automatically a guarantor and may be contacted only for legitimate verification—not to demand payment or shame the borrower. Contacting unrelated people from the borrower’s phone book for collection is prohibited.

Is contact-list access always illegal?

No. Limited access may be allowed to let you select a character reference or guarantor, or to derive proportional metadata where necessary for a specified and legitimate purpose. Unconstrained copying, storage, or use of contacts for harassment or collection from non-guarantors is prohibited. The facts, permission notices, actual data accessed, and subsequent use all matter.

Can I be jailed simply because I did not pay an online loan?

The 1987 Constitution states that no person shall be imprisoned for debt. A collector cannot lawfully create an arrest warrant or have you jailed merely by sending a threatening message. Separate offenses involving fraud, falsified documents, or other criminal conduct are different and require their own facts and lawful process.

What if the debt or amount is wrong?

Dispute it in writing. Identify the amount you accept, if any, and request an itemized computation, payment history, contract, and disclosure statement. Preserve proof of payments. Tell the collector that the amount is disputed, because communicating loan information while concealing a known dispute may itself be relevant to an SEC complaint.

What if the app is unregistered or has disappeared?

Report it to the SEC and provide every available identifier: app-store link, developer, website, numbers, email addresses, payment accounts, receipts, and screenshots. Report privacy misuse to the NPC and possible fraud or threats to cyber law enforcement. Lack of registration does not prevent regulators or police from receiving information, although identifying and serving the operator may be more difficult.

Can a character reference file a complaint?

Yes, if the reference’s own personal data was processed or used unlawfully, that person is a data subject and may complain to the NPC. The reference should preserve the message, identify how the lender obtained the number, request removal in writing, and document the response.

Does settling the loan end the privacy complaint?

Not necessarily. Payment may resolve the debt but does not automatically erase a past privacy violation, unlawful publication, or threat. Whether a complaint should continue or be settled depends on the evidence, relief sought, and any settlement terms. Do not sign a broad waiver without understanding it.

What may the agencies do?

The SEC may investigate, require responses, impose administrative sanctions, suspend or revoke authority, or refer issues to another agency. The NPC may order corrective measures, impose administrative fines, award appropriate indemnity, ban processing, or recommend criminal prosecution to the Department of Justice. Police and the NBI may investigate possible crimes. No particular result is guaranteed; each remedy depends on jurisdiction, proof, defenses, and due process.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the contract, communications, evidence, identities of the parties, and applicable regulator. Laws, official procedures, and filing channels were checked against primary government sources current as of 11 August 2026.