Quick answer

Online lenders may collect a legitimate debt, but they may not threaten, shame, deceive, insult, misuse your photos or contacts, or disclose your loan to people who are not lawful guarantors. Save the evidence first, secure your phone, complain in writing to the lender, and report the conduct to the proper agency:

Unfair debt collection: Securities and Exchange Commission (SEC)
Misuse or disclosure of personal data: National Privacy Commission (NPC)
Threats, fraud, scams, extortion, account compromise, or other possible crimes: PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline
Immediate danger: Call 911

You may report the same incident to more than one agency because debt-collection, privacy, and criminal issues are legally distinct. Filing a complaint does not automatically cancel a valid loan, but an unpaid balance never gives a lender permission to harass or publicly shame anyone.

What online lenders and collectors are prohibited from doing

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, protects financial consumers’ rights to fair treatment, data privacy, transparent information, and timely handling of complaints. It expressly prohibits abusive collection or debt-recovery practices.

For lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 identifies unfair practices that include:

Using or threatening violence or other criminal means against a person, reputation, or property
Threatening an action that cannot legally be taken
Using obscenities, insults, or profane and abusive language
Publishing or disclosing borrowers’ names or personal information to shame them, except for disclosures specifically allowed by law
Communicating loan information known, or which should be known, to be false
Failing to disclose that a debt is disputed when communicating information about it
Using false representations or deceptive means to collect
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions when the account is more than 15 days past due or the borrower has expressly agreed—through written, electronic, or recorded means—that those hours are the only reasonable times for contact
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers

Even when an exception permits contact at a particular hour, threats, deception, shaming, privacy violations, and other abusive conduct remain prohibited.

The lender cannot escape responsibility simply by blaming an outside collection agency. Under RA 11765, a financial service provider is responsible for its employees and agents and is solidarily liable with accredited third-party service providers for acts or omissions in transactions that include debt collection. SEC rules likewise place ultimate responsibility for collection practices on the lending or financing company.

Contact lists, references, and guarantors are not the same

The government’s March 18, 2026 Advisory on Online Lending Platforms draws important distinctions:

A character reference may be provided only for identification or verification purposes.
A guarantor must separately and expressly consent to assume responsibility if the borrower defaults.
For debt collection, the lender may contact the guarantor—not everyone in the borrower’s phone book.
Merely being listed as a contact or character reference does not make someone a guarantor.
An app may access contacts only in a limited and proportionate way for a specified legitimate purpose, such as allowing the borrower to choose a reference or guarantor or deriving proportionate metadata where necessary. Unrestricted harvesting or processing of the entire contact list is prohibited.
Once an app permission has served its purpose, the app should prompt the user to turn it off or revoke it.

Access to the camera or photo gallery may be justified for identity verification or know-your-customer procedures. Using a borrower’s selfie, ID, altered photograph, or other image to embarrass or pressure them is not a legitimate extension of that purpose.

These rules arise from the Data Privacy Act of 2012, Republic Act No. 10173 and the NPC’s loan-processing rules, including NPC Circular No. 20-01 as amended by NPC Circular No. 2022-02. The relevant issuances are available on the NPC’s official circulars page.

What to do immediately

1. Deal with any immediate safety risk

If a message contains a credible threat of physical harm, someone has appeared at your home or workplace, or you believe anyone is in immediate danger, call the nationwide Unified 911 emergency hotline and contact the nearest police station.

Do not arrange a private meeting with a threatening collector. Tell a trusted person what is happening and avoid sharing your location publicly.

2. Preserve evidence before blocking numbers or uninstalling the app

Save complete, unedited copies of:

Text messages, chat threads, emails, social-media messages, and public posts
Screenshots showing the sender’s number, username, profile URL, date, and time
Call logs showing the number, frequency, duration, and time of calls
Voicemails and messages the system has already recorded
Messages sent to relatives, friends, co-workers, employers, or references
Screenshots of altered photos, public-shaming posts, threats, or false accusations
The app’s store page, developer name, website, privacy notice, and requested permissions
The corporate name, SEC registration number, and Certificate of Authority number displayed by the app
The loan agreement, disclosure statement, repayment schedule, statement of account, and payment receipts
The amount released, charges deducted, payments made, and amount being demanded
Previous complaints to the lender and any ticket numbers or replies
Proof of harm, such as employer notices, medical documents, or expenses, if relevant

Ask every contacted person to preserve the original message on their own device and prepare a truthful affidavit if needed. Keep a chronological incident log stating what happened, when, through which account or number, who witnessed it, and what personal information was disclosed.

Avoid secretly recording private telephone conversations. The Anti-Wiretapping Act, Republic Act No. 4200, generally prohibits secretly recording a private communication without authorization from all parties. Preserve call logs and make contemporaneous written notes instead, unless a lawyer or law-enforcement officer advises that a specific recording is lawful.

3. Identify the company behind the app

The app’s brand name may differ from the legal name of the lender. Check:

The loan agreement and disclosure statement
The app’s privacy notice and terms
Payment receipts and account names
The developer information in the official app store
The corporate name, SEC registration number, and Certificate of Authority number shown in the app or advertisement

If this information is missing, inconsistent, or appears fabricated, take screenshots and include that fact in the SEC complaint. Do not send payment to a collector’s personal account merely because the person is threatening you. Verify the official payment channel directly with the lender.

4. Secure your accounts and device

After preserving the evidence:

Revoke unnecessary permissions for contacts, photos, camera, microphone, location, SMS, and storage.
Change passwords for email, social media, banking, and e-wallet accounts if the app or collector may have obtained them.
Enable two-factor authentication where available.
Remove unfamiliar account recovery numbers, devices, and active sessions.
Block abusive numbers or accounts after capturing the evidence.
If the app was installed from an unofficial source, have the phone checked for malicious software and uninstall the app after preserving its identifying information and relevant records.
Contact your bank or e-wallet immediately if credentials, one-time passwords, or funds may have been compromised.

Revoking permissions does not necessarily erase information already copied by the lender. Address that separately in your written privacy complaint.

Send a written complaint to the lender

RA 11765 requires a financial service provider to maintain a single consumer-assistance mechanism offering free help with complaints, inquiries, and requests.

Send your complaint to the lender’s official consumer-assistance unit, customer-service address, or data protection officer. Use a channel that produces proof of delivery. Include:

Your name and loan or account reference
The app’s name and the lender’s legal name, if known
The collector’s names, numbers, usernames, or agency
A dated, chronological account of the conduct
The personal information accessed or disclosed
The people who were contacted and what they were told
Whether you dispute the debt, amount, fees, or payment records
A list of attached evidence
The action you want taken

Ask the lender to:

Stop the harassment and unauthorized third-party contact
Investigate the collector and preserve relevant call, account, access, and disclosure logs
Provide an accurate statement of account
Identify the lawful basis and purpose for processing the disputed personal data
Identify the recipients of any disclosure
Correct false or inaccurate information
Stop further unauthorized processing or sharing
Delete or block data that is no longer necessary or lawfully retained
Confirm its findings and corrective action in writing

Keep the sent message, delivery receipt, automatic acknowledgment, ticket number, and every response. This written notice is particularly important for an NPC complaint.

Report unfair debt collection to the SEC

The SEC regulates lending and financing companies and their online lending platforms.

File through the SEC iMessage ticketing system. The SEC’s current user guide directs complainants to sign in through eSECURE and select:

Financing and Lending Companies Department → Legal and Enforcement Division → Complaints on Financing and Lending Companies

Attach the evidence and clearly identify both the app name and the corporate operator. Include the loan documents, payment records, collector details, screenshots, communications sent to third parties, and your written complaint to the lender.

The March 2026 government advisory also lists the SEC hotline as 1-4732 (1-4SEC).

The SEC can investigate regulatory violations and impose appropriate sanctions, but a regulatory complaint does not by itself rewrite the contract, cancel the balance, or declare that no debt exists. Questions about the validity of the contract, the enforceability of particular charges, or damages may require adjudication or court proceedings based on the documents and facts.

File a privacy complaint with the NPC

Use the NPC route when the app or collector:

Harvested or misused your contacts
Disclosed your loan, identity, photos, or other data without a lawful basis
Used your data for shaming, threats, or another unauthorized purpose
Continued unnecessary data processing after its purpose ended
Refused a valid request for access, correction, blocking, or deletion
Used deceptive consent screens or excessive permissions

Observe the 15-day written-notice rule

Under the 2021 NPC Rules of Procedure, as amended, a complaint generally will not be given due course unless:

You first informed the lender or other responsible entity of the privacy violation in writing; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving your notice.

Attach proof that the respondent received the notice.

The NPC may waive this requirement for properly established good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy from the respondent, or patently illegal conduct. If urgent protection is needed, explain the danger and provide supporting evidence instead of simply omitting the prior notice.

Prepare and submit the complaint

Download the latest notarized Complaint-Affidavit or Complaints-Assisted Form from the NPC’s official complaint-filing page. It should identify the respondent, describe the personal data involved, narrate the facts chronologically, state the relief requested, and list the evidence.

Attach:

All correspondence with the respondent
Screenshots and original electronic records
Loan and app records relevant to the privacy issue
Witness affidavits, if any
Proof of identity
The required certification against forum shopping and other documents included in the current form

A standard NPC complaint filing fee of ₱500 currently applies. Additional fees apply if damages are claimed. Government and qualifying indigent complainants may be exempt, and the NPC may waive the fee for good cause in proper cases. Confirm the assessment and payment instructions on the NPC’s current schedule of fees before paying.

A notarized complaint may be filed personally, by courier or registered mail, or—when authorized—by sending a clear scanned copy and attachments to complaints@privacy.gov.ph. Current contact details and office information are on the NPC contact page.

Report threats, fraud, scams, or other possible crimes

A regulatory or privacy complaint is not a substitute for a police report when the conduct may be criminal. Depending on the evidence, threats, extortion, fraudulent representations, account intrusion, identity misuse, defamatory online publication, or other conduct may implicate criminal laws. The precise offense should be assessed by law enforcement and prosecutors rather than guessed in the complaint.

The March 2026 joint government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

Provide original files where possible, not merely cropped screenshots. Bring a valid ID, your incident chronology, the lender’s information, loan documents, URLs, numbers, account identifiers, and proof of any financial loss. Obtain and keep the complaint or reference number.

What the lender may still lawfully do

A lender may generally:

Contact the borrower through reasonable and lawful means
Send accurate payment reminders and statements
Use a lawful collection agency
Contact a person who knowingly and expressly consented to be a guarantor
Report credit information through lawful channels
Enforce a valid agreement through proper legal proceedings

A lender may also retain information when reasonably necessary to administer the loan, comply with law, or establish, exercise, or defend legal claims. A deletion request is therefore not an automatic right to destroy every loan record. The company must still have a lawful purpose, retain only what is necessary, protect the information, and securely dispose of it when retention is no longer justified.

Do not ignore an authentic demand letter, subpoena, summons, or court order. Verify it through the issuing court or agency and obtain legal advice promptly. A collector’s threatening text is not the same as formal legal process.

Common mistakes that weaken a complaint

Deleting chats, uninstalling the app, or resetting the phone before preserving evidence
Naming only the app and not the corporation that operates it
Submitting cropped screenshots that hide the sender, date, URL, or surrounding conversation
Treating a character reference as if that person automatically agreed to guarantee the loan
Secretly recording calls without considering the Anti-Wiretapping Act
Posting unredacted IDs, account numbers, contacts, or private messages publicly
Sending the NPC complaint without proof of prior written notice or an explanation supporting waiver
Making unsupported accusations instead of stating observable facts
Paying a collector through an unverified personal account
Assuming that reporting harassment automatically erases the debt
Ignoring genuine legal papers because earlier threats were fake

When legal help is urgent

Consult a Philippine lawyer promptly when:

A credible threat involves physical harm, stalking, extortion, sexual images, or danger to a child
Personal data or altered images are being widely published
Bank or e-wallet funds have been taken
The lender has filed a court case or you received formal legal process
You need an urgent order to stop continuing data processing or publication
The amount, interest, fees, identity of the creditor, or validity of the loan is seriously disputed
You want to claim substantial damages
Several lenders or collection agencies are involved and the correct respondents are unclear

If you cannot afford private counsel, ask the Public Attorney’s Office whether you qualify for assistance or contact an accredited legal-aid office.

Penalties and possible outcomes

Possible regulatory outcomes include corrective orders, cease-and-desist measures, administrative fines, suspension, or revocation of authority to operate. Privacy violations may result in NPC enforcement, administrative fines, indemnity where legally supported, or referral for prosecution. The result depends on the specific violation and the evidence.

Under RA 11765, a person who willfully violates the Act or its implementing rules or orders may, upon conviction, be punished by imprisonment of one to five years, a fine of ₱50,000 to ₱2 million, or both. These penalties are not automatic upon the filing of a complaint; liability must be established in the proper proceeding.

Actions or claims under RA 11765 generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, with an absolute ten-year limit from the violation. Different privacy, civil, and criminal claims may follow different rules, so report promptly rather than relying on the maximum period.

Frequently asked questions

Can I complain even if I really owe the money?

Yes. A genuine debt does not authorize harassment, threats, deception, public shaming, or unlawful processing of personal data. Continue addressing the legitimate balance through verified channels while separately documenting and reporting the misconduct.

Can the collector contact my family, friends, or employer?

For debt collection through an online lending platform, the lender may contact a person who expressly consented to be a guarantor. A character reference may be contacted for identification or verification, not treated as a guarantor or pressured to pay. Disclosing the loan to unrelated contacts for collection or shaming is prohibited.

What if I allowed the app to access my contacts?

Permission does not authorize unlimited use. The processing must remain lawful, transparent, necessary, and proportionate to a specified purpose. The government’s 2026 advisory prohibits unrestricted contact-list processing and using contacts outside the borrower’s guarantors for collection.

Can I file with the SEC and NPC at the same time?

Yes. The SEC addresses unfair collection and violations by lending or financing companies; the NPC addresses personal-data processing. If threats, fraud, or other possible crimes are involved, a law-enforcement report may also be appropriate.

Must I wait 15 days before reporting?

You may report unfair collection to the SEC and urgent threats to law enforcement immediately. For a formal NPC complaint, you generally must first give the respondent written notice and allow 15 calendar days for a response, unless the NPC’s grounds for waiver are properly alleged and supported.

What if the app or lender appears unlicensed?

Preserve the app page, website, payment instructions, advertisements, and corporate claims. Report it to the SEC through iMessage and report related threats, fraud, or scams to the listed cybercrime authorities. Lack of registration does not prevent you from reporting the conduct.

Will filing a complaint stop all collection?

Not necessarily. The lender may continue lawful collection of a valid debt. Your complaint targets prohibited methods, privacy violations, inaccurate demands, or other unlawful conduct. Ask the lender and regulator for specific protective or corrective relief based on the evidence.

This article provides general legal information, not advice for a particular case or a substitute for reviewing the loan documents and evidence with a Philippine lawyer. Laws, procedures, agency channels, and fees were checked against official and controlling sources current as of August 6, 2026.