Quick answer

Online lending apps may collect a valid debt, but they may not threaten violence, use obscene or insulting language, publicly shame you, misrepresent legal consequences, disclose your loan to unauthorized people, or use your contacts and photos to pressure you. A character reference is not automatically a guarantor, and lenders generally may not contact people in your phonebook for debt collection unless the person expressly agreed to be a guarantor.

Report unfair collection practices by lending or financing companies to the Securities and Exchange Commission (SEC). Report unlawful collection, use, or disclosure of personal data to the National Privacy Commission (NPC). Report threats, extortion, fraud, impersonation, or other possible crimes to law enforcement. One incident may properly be reported to more than one agency.

A complaint does not erase a legitimate loan. Continue addressing any valid balance through verified, lawful channels while separately challenging harassment, privacy violations, or disputed charges.

What collectors are not allowed to do

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing and lending companies—and collectors acting for them—from engaging in unfair debt collection practices. Prohibited conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that amounts to abuse or an offense.
Publishing a borrower’s name or personal information because of alleged nonpayment, except when disclosure is legally permitted.
Communicating loan information known, or reasonably expected, to be false, including failing to disclose that a debt is disputed when that matters.
Using false representations or deceptive means to collect a debt or obtain information about a borrower.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions: when the account is more than 15 days past due, or when the borrower has expressly agreed—through written, electronic, or recorded means—that those hours are the only reasonable or convenient time for contact.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers.

These rules do not prevent a creditor from sending truthful payment reminders, negotiating repayment, making a lawful demand, reporting information through a legally authorized credit-reporting process, or filing an appropriate case. The collection must still be conducted in good faith and by lawful means. See the official SEC issuance page for MC No. 18 and the SEC’s application of the circular in an online-lending enforcement order.

Ordinary nonpayment of debt, by itself, is not a ground for imprisonment. Article III, Section 20 of the 1987 Constitution prohibits imprisonment for debt. That protection does not excuse a separate offense, such as fraud, if its legal elements and evidence exist. A collector may truthfully state that a lawful remedy will be pursued, but may not falsely claim that arrest or imprisonment is automatic merely because a payment is late.

When collection becomes a privacy violation

The Data Privacy Act requires personal data to be processed fairly, for a declared and legitimate purpose, and only to the extent necessary and proportionate to that purpose. Consent to apply for a loan is not unlimited permission to copy, publish, or weaponize the borrower’s contacts, photographs, identification documents, social-media information, or other data.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

An app may request only permissions necessary for specified and legitimate loan-processing purposes.
Camera or photo access may be used for identity verification or know-your-customer requirements, but a borrower’s image may not be used for harassment or embarrassment.
Access to contacts must not be unbridled, excessive, or disproportionate.
A character reference may be contacted for identity or information verification, but is not automatically a guarantor.
A guarantor must expressly consent to assume responsibility for the loan.
A character reference must be told that the borrower named them, how their details were obtained, and how they may request removal of their data as a reference.
Personal data may not be used for harassment, collection from people other than guarantors, or unfair collection practices.
Data must be retained only as long as necessary for its original purpose, legal claims, or a period required by law, and must then be securely disposed of.

The DICT, NPC, and SEC reaffirmed these rules in their 18 March 2026 Joint Advisory on Online Lending Platforms. It expressly states that contacting people in a borrower’s contact list other than consenting guarantors for debt collection is prohibited.

Not every use of borrower data requires consent. Depending on the facts, processing may instead be necessary to perform the loan contract, comply with law, establish or defend a legal claim, or satisfy another lawful basis under the Data Privacy Act. Consequently, withdrawing consent or closing an account does not always require the lender to delete every loan record immediately. It does not, however, authorize public shaming, excessive collection, or disclosure to unrelated contacts.

Where to report the conduct

Problem	Primary reporting channel
Harassment or unfair collection by a lending or financing company, its app, or its collector	SEC Financing and Lending Companies Department through SEC iMessage; hotline 1-4732 (1-4SEC)
Unauthorized access, excessive collection, use of contacts or photos, public disclosure, or refusal to honor privacy rights	National Privacy Commission
Threats, extortion, fraud, impersonation, account compromise, or another possible cybercrime	DICT Cyber Hotline, NBI Cybercrime Division, PNP Anti-Cybercrime Group, or the appropriate local police unit
Conduct by a bank, digital bank, e-money issuer, or another BSP-supervised institution	The institution’s consumer-assistance mechanism first, then the BSP Consumer Assistance Mechanism
Immediate danger or a crime in progress	Call 911

Agency jurisdiction depends on the company behind the app—not merely the app’s brand name. Some loan products are offered by SEC-regulated lending or financing companies; others may be offered by BSP-supervised institutions.

What to do immediately

1. Preserve the evidence before blocking or uninstalling

Save the original material whenever possible:

Screenshots showing the complete message, sender’s number or account, date, and time.
The full conversation—not only the most offensive line.
SMS exports, emails with headers, chat exports, voicemails, and call logs.
Public posts, comments, profile URLs, group names, and the date and time each page was accessed.
Messages received by relatives, coworkers, employers, or other contacts.
The app-store listing, developer name, app URL, version, privacy notice, and permissions displayed on the device.
Loan agreement, disclosure statement, statement of account, payment history, receipts, and collection notices.
The corporate name, SEC registration number, Certificate of Authority number, collector’s name, payment account, and any reference or ticket numbers.
Proof of harm, when relevant, such as an employer’s notice, medical record, counseling receipt, lost-business record, or expenses caused by the incident.

Ask people who received messages about you to keep the original messages and prepare a dated written account of what they received. Do not edit, crop away identifying details, annotate, or overwrite the only copy. Keep one working copy and one secure backup.

Avoid secretly recording private calls without legal advice. The Anti-Wiretapping Act generally prohibits recording a private communication without authorization from all parties. Preserve existing voicemails and call logs, or conduct future communications in writing.

2. Secure your phone and accounts

After preserving evidence:

Review and revoke unnecessary permissions for contacts, storage, camera, microphone, location, and social media.
Change reused or exposed passwords from a trusted device.
Enable multi-factor authentication.
Check email, e-wallet, bank, and social-media accounts for unfamiliar logins or transactions.
Tell affected contacts not to engage with collectors, click links, disclose information, or send payment.
Report any unauthorized financial transaction immediately to the institution holding the account.

Do not send money to a new personal account merely because a collector threatens you. Verify payment instructions through the lender’s official channel and obtain a receipt.

3. Identify the company behind the app

Look at the loan agreement, disclosure statement, privacy notice, payment receipt, app-store developer page, and collection messages. SEC rules require online lending platforms to display their corporate name, SEC registration number, and Certificate of Authority number conspicuously.

An SEC corporate registration alone does not prove authority to operate as a lending or financing company. Record both the company registration and its claimed Certificate of Authority. If the company or authority cannot be verified, include that fact and the supporting screenshots in the SEC report. Do not assume that an unregistered operator’s loan is automatically void; contract enforceability and regulatory violations are separate questions.

4. Send a written complaint to the lender and its data protection officer

Use an email address or complaint channel shown in the contract, privacy notice, or official app listing. Keep proof of delivery. A concise notice may say:

I dispute and object to the following conduct: [describe each message, disclosure, contact, or threat with dates]. Stop contacting persons who did not expressly agree to act as my guarantors, stop publishing or using my personal data for harassment, and preserve all relevant records. Please identify the company and collection agency responsible, the source and purpose of the personal data used, the persons to whom it was disclosed, and the action taken on this complaint. Please respond in writing.

If the amount is disputed, identify the specific charge and request an itemized statement. Avoid admitting facts you do not know to be true. If you acknowledge a balance, you may still state that your complaint concerns the collection method and privacy violation.

This written step is especially important for an NPC complaint. Under the amended NPC Rules of Procedure, the complainant normally must first notify the respondent in writing and allow it to act. The requirement is satisfied when the response is untimely or inappropriate, or when no response is received within 15 calendar days from the respondent’s receipt. Keep the sent message, delivery confirmation, and response.

The NPC may waive this requirement for proven good cause or a serious violation, including grave and irreparable harm, lack of a plain and adequate remedy, or conduct that is patently illegal. Do not wait 15 days before seeking police or emergency assistance for an active threat.

Filing with the SEC

For harassment and unfair collection by lending and financing companies:

Open a ticket through SEC iMessage.
Direct the concern to the Financing and Lending Companies Department when prompted.
Identify both the app name and the legal company name, if known.
Give a chronological account with dates, numbers, accounts, and exact conduct.
Attach the loan documents, screenshots, contact-list disclosures, messages to third parties, and proof that you complained to the company.
State whether the debt or amount is disputed and whether collection is continuing.
Save the electronic ticket number and use it for follow-ups.

The SEC’s current iMessage guide describes iMessage as its official centralized platform for inquiries, complaints, incidents, and requests, with a trackable ticket for each submission.

Report the app even if its operator appears unregistered or the app is no longer available in an app store. Include archived screenshots, downloaded agreements, payment destinations, and every identifier you have.

Filing a formal privacy complaint with the NPC

A borrower, character reference, guarantor, relative, coworker, or other person may complain if their own personal data was affected. A representative generally needs a special power of attorney.

Follow the NPC’s current formal complaint instructions and use its March 2026 Complaint-Affidavit Form. The complaint should:

Be completed accurately and notarized.
Identify the complainant and respondent.
Describe the personal data processed and the alleged violation chronologically.
Include proof that the respondent was notified in writing, or clearly explain and prove why waiver of that requirement is justified.
Attach the evidence and witness affidavits.
Include a valid government-issued ID.
Contain the required verification and certification against forum shopping.
Identify the relief requested.

The current form warns that failure to attach supporting evidence may cause outright dismissal. A complaint may also be dismissed if the parties cannot be identified or traced despite diligent efforts.

The complaint may be submitted personally, by registered mail, by courier, or through an email channel authorized by the NPC. The NPC’s filing page currently directs scanned complaints to complaints@privacy.gov.ph. Its listed office is at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Barangay Paligsahan, Quezon City 1103. Check the filing page immediately before submission in case operational instructions have changed.

The current schedule lists a ₱500 filing fee, plus applicable legal-research or damages-related fees. Indigent litigants may seek exemption if both stated conditions are met: the gross income of the litigant and immediate family does not exceed twice the applicable monthly minimum wage, and the litigant does not own real property with a fair market value exceeding ₱300,000. Supporting certificates and affidavits are required. See NPC Circular No. 2023-01.

Do not delay unnecessarily. The NPC’s amended rules apply statutory prescriptive periods that can vary with the alleged violation, while other civil, criminal, or regulatory claims may have different deadlines.

Reporting threats, fraud, or cybercrime

The SEC and NPC handle regulatory and privacy violations, but they do not replace law enforcement when conduct may be criminal. Depending on the precise words, publication, intent, and evidence, threats, coercion, extortion, fraudulent representations, defamatory online posts, or unauthorized data use may implicate the Revised Penal Code, the Cybercrime Prevention Act, the Data Privacy Act, or another law. The investigating authority or prosecutor—not the complainant—determines the proper charge.

The March 2026 government advisory lists these reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

An email report may begin the referral or assessment process; ask the receiving office what sworn complaint, personal appearance, device examination, or additional evidence it requires. For immediate danger or a crime in progress, call 911 and move to a safe location.

If the provider is supervised by the BSP

If the loan was issued by a bank, digital bank, non-bank electronic-money issuer, or another BSP-supervised institution, first use that institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.

If the response is unsatisfactory, escalate through the BSP Online Buddy on the BSP website or submit the prescribed complaint form to consumeraffairs@bsp.gov.ph. Include proof that you first complained to the institution. The BSP’s current complaint guide also clarifies that complaints involving lending and financing companies, online lending platforms, and their collection agencies are ordinarily directed to the SEC.

Common mistakes that weaken a complaint

Deleting the app, chat, or account before preserving evidence.
Submitting cropped screenshots that omit the sender, date, time, or context.
Naming only the app brand and not the company, collector, developer, or payment account.
Making conclusions without describing the actual words, recipients, dates, and data involved.
Failing to prove that third parties received the disclosure.
Filing an NPC complaint without first giving written notice to the respondent—or without explaining and proving why the requirement should be waived.
Assuming that consent to borrow permits access to every contact or unlimited use of personal data.
Assuming that filing a complaint cancels the debt, pauses interest, or prevents a lawful collection case.
Paying an unverified collector or surrendering an OTP, PIN, password, or identification document.
Secretly recording calls without considering the Anti-Wiretapping Act.
Posting unredacted screenshots publicly and thereby exposing your own ID, address, account number, or other people’s data.
Ignoring a summons, subpoena, formal demand, or order from a court or government agency.

When legal help is urgent

Seek prompt assistance from a lawyer, qualified legal-aid office, law enforcement, or the appropriate regulator when:

A collector threatens physical harm, kidnapping, arrest without lawful basis, property damage, or violence against family members.
Money is demanded in exchange for not publishing personal data or photographs.
Your ID, face, signature, contacts, account credentials, or device data may have been stolen or used for identity fraud.
Intimate images, medical information, children’s data, or other highly sensitive information is threatened or disclosed.
Harassment continues after written notice or spreads to your employer, clients, school, or community.
You receive actual court papers, a prosecutor’s subpoena, or an agency order.
The amount, interest, fees, payment history, or identity of the creditor is materially disputed.
You need an urgent order to stop ongoing processing or publication. The NPC rules permit an application for a temporary ban on processing, but it has procedural, hearing, fee, and bond requirements.

Frequently asked questions

Can the app contact my family, friends, or employer?

Not merely because their numbers were found in your phone. For debt collection by lending or financing companies, the 2026 joint advisory states that only a person who expressly consented to be a guarantor may be contacted regarding the loan obligation. A character reference may be contacted for legitimate identity or information verification, but is not automatically a guarantor.

Can the lender post my name or photograph online?

Public shaming and unauthorized publication of a borrower’s personal information may violate SEC collection rules and the Data Privacy Act. Preserve the post, URL, account details, comments, date, and time before requesting removal or reporting it to the platform.

Does giving the app permission to access contacts make harassment legal?

No. Permission or consent does not authorize excessive, disproportionate, deceptive, or abusive processing. The purpose and extent of access must remain legitimate, necessary, and transparent.

Can I demand deletion of all my data?

You may exercise applicable rights to object, correct, block, or erase data, particularly when it is unlawfully obtained or used. However, a lender may retain information genuinely necessary to administer an existing loan, comply with law, or establish or defend legal claims. Ask the lender to identify the legal basis, purpose, recipients, and retention period for data it refuses to delete.

I was only named as a character reference. Can I complain?

Yes, if your own personal data was collected, used, or disclosed improperly. Ask the company how it obtained your details, request removal as a character reference, preserve any collection messages, and complain to the NPC if the violation is not properly addressed.

Do I need a police blotter before approaching the SEC or NPC?

Not ordinarily. Submit the documents required by the receiving agency. A police or cybercrime report is appropriate when the facts involve threats, fraud, extortion, impersonation, account compromise, or another possible offense.

What if the lender says it used a third-party collection agency?

That does not automatically remove the lender’s responsibility. Under the Financial Products and Services Consumer Protection Act, a financial service provider remains responsible for its representatives and may be solidarily liable with an accredited third-party service provider for acts connected with services such as debt collection. See Republic Act No. 11765.

Will reporting stop collection or cancel the balance?

Not automatically. Agencies may investigate, order corrective action, impose sanctions, restrict data processing, or refer appropriate matters for prosecution, but the validity and amount of the debt remain separate issues. Continue communicating in writing, request an itemized balance, and make payments only through verified channels.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights, remedies, jurisdiction, and deadlines may depend on the loan documents, company behind the app, exact communications, and available evidence. Official sources and reporting channels were checked as of 31 July 2026.