Quick answer

Online lenders may demand payment of a valid debt, but they may not harass, threaten, publicly shame, deceive, or misuse your personal data to collect it. They generally may not contact people in your phonebook about your debt unless the person expressly agreed to be your guarantor. A character reference is not automatically a guarantor.

Report unfair collection practices to the Securities and Exchange Commission (SEC). Report unauthorized access, disclosure, excessive collection, or other misuse of personal data to the National Privacy Commission (NPC). Threats, fraud, impersonation, or other possible crimes should also be reported promptly to the Philippine National Police (PNP), National Bureau of Investigation (NBI), or DICT Cyber Hotline.

These complaints address unlawful conduct; they do not automatically cancel a legitimate loan or stop lawful collection.

What conduct may be unlawful?

Under the Data Privacy Act of 2012, its implementing rules, NPC loan-related regulations, the Financial Products and Services Consumer Protection Act, and SEC Memorandum Circular No. 18, lending and financing companies—and collection agencies acting for them—must use lawful and fair collection methods.

Possible violations include:

Threatening violence, arrest without lawful basis, damage to property, or harm to you, your family, reputation, employment, or business
Using obscene, insulting, humiliating, or profane language
Repeatedly calling or messaging in a manner intended to harass
Pretending to be a police officer, lawyer, court employee, government agency, or another person
Sending fake warrants, subpoenas, court orders, demand letters, or fabricated legal documents
Threatening an action that the collector cannot legally take
Posting or circulating your photograph, government ID, loan details, alleged delinquency, or insulting statements on social media or in group chats
Telling your employer, co-workers, relatives, friends, or other third parties about your debt when no lawful exception applies
Contacting people taken from your phone’s contact list for collection when they are not guarantors
Treating a character reference as liable for the loan without that person’s express agreement
Accessing, copying, or using contacts, photographs, messages, location data, social-media information, or other device data beyond what is necessary for a specified and legitimate purpose
Continuing to use personal data for marketing, cross-selling, or unrelated purposes without a valid legal basis
Using false representations or deceptive methods to collect the debt or obtain information
Communicating before 6:00 a.m. or after 10:00 p.m., subject to the limited exceptions in SEC rules, such as documented consent to those hours or an account more than 15 days past due

The government’s March 2026 joint advisory on online lending platforms confirms that unnecessary app permissions and unauthorized, excessive, or disproportionate processing are prohibited. For debt collection, lenders may contact a guarantor—but not everyone in a borrower’s contact list.

A lender may ask for character references to verify identity or application information. It must inform the reference how the contact details were obtained and provide an option to have those details removed as a reference. A guarantor, by contrast, must separately and expressly consent to assume responsibility if the borrower defaults.

What lawful collection may still look like

Not every collection message is harassment. A lender or authorized collector may ordinarily:

Remind you of a due or overdue payment
State the balance and contractual consequences of default
Send a truthful demand letter
Propose restructuring or another payment arrangement
File a lawful civil collection case
Contact a person who expressly became a guarantor or co-maker, within the limits of the agreement and the law
Retain data that remains necessary to administer the loan, comply with law, or establish, exercise, or defend legal claims

The distinction usually depends on the message’s content, frequency, timing, recipients, truthfulness, and use of personal data. Preserve the complete exchange rather than isolated screenshots whenever possible.

What to do immediately

1. Protect yourself first

If a message contains a credible threat of immediate physical harm, stalking, extortion, or violence, contact the police or call 911. Do not meet a collector alone or disclose your location merely because the collector demands it.

If the sender claims to have a warrant or court order, verify it independently with the named court or agency. Do not rely on phone numbers or links supplied in the threatening message.

2. Preserve the evidence before blocking or deleting anything

Save:

Full screenshots showing the sender, phone number or account, date, time, and complete message
Screen recordings showing the conversation, profile, group-chat participants, or social-media post
Call logs and, if lawfully available, voicemail or recordings
URLs, usernames, app names, app-store listings, and developer information
Copies of messages sent to relatives, co-workers, employers, references, or other contacts
Statements or affidavits from people who received collection messages
The loan agreement, disclosure statement, repayment schedule, receipts, and proof of payments
The lender’s corporate name, SEC registration number, and Certificate of Authority number as displayed in the app or advertisement
The privacy notice and consent screens shown when you applied
Screenshots of the app permissions requested or granted
Emails or messages in which you objected and the company’s response
Any fake legal document, edited photograph, public post, or threat
Evidence of resulting harm, such as employer correspondence, medical records, expenses, or account-security alerts

Keep original files when possible. Back them up somewhere the lending app cannot access. Avoid editing, cropping, annotating, or forwarding the only copy. Prepare a simple timeline identifying each incident and its recipient.

3. Secure your phone and accounts

After documenting the permissions:

Revoke the app’s access to contacts, photos, camera, microphone, location, SMS, storage, and other data that it no longer needs
Change passwords for affected email, social-media, financial, and cloud accounts
Enable multi-factor authentication
Review logged-in devices and terminate unfamiliar sessions
Warn contacts not to click links, send money, or disclose information to collectors
Ask your mobile provider about blocking or reporting abusive numbers
Uninstall the app if it is safe to do so and you have preserved the records you need

Revoking permissions or uninstalling an app does not erase a valid loan. Continue keeping records of payments and communicate through a traceable channel.

4. Send a written notice to the company

Write to the lender’s official customer-service channel and data protection officer, if identified. State:

Your name and account or loan reference
The specific conduct complained of
The dates, numbers, accounts, employees, or collection agencies involved
The personal data accessed or disclosed
The names of third parties contacted
That you object to harassment and unauthorized or excessive processing
The action requested, such as stopping third-party contact, removing reference data, correcting inaccurate data, preserving records, identifying recipients, or explaining the legal basis for processing
A reasonable request for written acknowledgment and resolution

Do not admit an amount you genuinely dispute merely to make the harassment stop. You may state that you are willing to discuss the account through lawful channels while expressly disputing the abusive conduct.

Keep proof that the notice was received. This is especially important for an NPC complaint.

How to report unfair collection practices to the SEC

The SEC regulates lending and financing companies and their online lending platforms. Its rules also cover third-party collection service providers acting as their agents.

Submit the complaint through the SEC’s official iMessage portal, selecting the service for the Financing and Lending Companies Department when available. The SEC’s March 2026 advisory also lists the hotline 1-4732 (1-4SEC).

Prepare:

A completed SEC complaint form, if required by the portal
A valid government-issued ID
Your loan documents and disclosure statement
Screenshots, recordings, witness statements, and other evidence
The lender’s exact corporate name, not only the app’s brand name
A chronological account of the collection conduct
The relief or regulatory action you are requesting

Use one complaint form for each respondent company. If a collection agency is involved, identify both the agency and the lender that engaged it.

The SEC may send the complaint to the company for an answer and, if there are sufficient grounds, begin an administrative case. It may also endorse privacy or criminal aspects to the proper agency. The SEC does not, through this complaint process, rewrite payment terms, declare the loan or interest void, or cancel the debt.

How to report a privacy violation to the NPC

Use the NPC route when the complaint involves matters such as:

Harvesting or using your contact list
Disclosing your loan or identity to unauthorized people
Posting your photograph, ID, or loan information
Excessive or unnecessary app permissions
Refusal to explain how your information was obtained or used
Failure to honor applicable data-subject rights
Use of a character reference’s details for collection or marketing
Inaccurate, unauthorized, or malicious processing of personal data

Exhaust the company-level remedy first

Under the NPC’s 2021 Rules of Procedure, you ordinarily must first inform the company or other respondent in writing of the privacy violation and allow it to act. You may proceed when it fails to take timely or appropriate action or does not respond within 15 calendar days from receipt of your written notice. Attach proof of notice and receipt.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, no plain and adequate remedy, or conduct that is patently illegal. Do not assume a waiver will be granted; explain and prove why urgent NPC intervention is necessary.

Prepare the formal complaint carefully

Follow the NPC’s current complaint-filing instructions and use its latest complaint-assisted form. The complaint generally must be:

In writing and signed
Verified and notarized
Accompanied by a certification against forum shopping
Supported by relevant documents and witness affidavits
Clear about the parties, facts, privacy rights involved, and relief requested

The NPC warns that failure to attach evidence or comply with required form and content may lead to outright dismissal.

The current NPC page allows filing in person, by courier or registered mail, or by sending a scanned complaint to complaints@privacy.gov.ph. Check the official page before submission for the latest form, address, fees, and technical requirements. Electronic documents should be properly signed and submitted in the prescribed format.

If someone files for you, the NPC generally requires appropriate written authority, such as a special power of attorney. Disclose any related complaint or case filed with another court, tribunal, or agency as required by the certification against forum shopping.

When to report to cybercrime authorities

Report conduct promptly when it may involve threats, extortion, fraud, identity theft, impersonation, unauthorized account access, fake legal documents, or defamatory online publication.

The March 2026 government advisory identifies these official channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

For immediate danger, contact 911 or the nearest police station. Bring the device containing the original messages if requested, but keep backups. Ask for a complaint, blotter, or reference number.

Whether particular conduct constitutes grave threats, unjust vexation, cyberlibel, computer-related identity theft, or another offense depends on the exact words, acts, intent, publication, evidence, and applicable prescriptive period. A prosecutor or lawyer should assess the facts rather than relying solely on the collector’s label or your own characterization.

What if the lender is a bank or BSP-supervised institution?

If the provider is a bank, digital bank, electronic-money issuer, payment-system operator, or another institution supervised by the Bangko Sentral ng Pilipinas, first use the institution’s own consumer-assistance mechanism. If the matter remains unresolved, escalate it through the BSP Consumer Assistance Mechanism, including BSP Online Buddy or the official complaint form and email channel.

An app’s branding does not always reveal the regulated entity behind the loan. Check the loan agreement, disclosure statement, privacy notice, and disbursement records to identify the actual creditor.

If you are only a contact or character reference

You can complain even if you did not borrow money.

Tell the collector in writing that:

You are not the borrower
You did not agree to be a guarantor or co-maker
You object to the use of your details for collection
You want to know how your information was obtained
You request removal of your details where continued processing has no lawful basis
Further communication should stop except for a lawful response to your request

Preserve every message. Report the lender to the NPC if it misused your personal data, and to the SEC if it contacted you as part of unfair debt collection. If the lender claims you guaranteed the debt, ask for the document bearing your express agreement and obtain legal advice before acknowledging liability.

Common mistakes to avoid

Deleting the app or messages before preserving evidence
Posting your government ID, loan agreement, or unredacted screenshots publicly
Reporting only the app’s brand name without identifying the corporate lender
Sending vague allegations without dates, numbers, recipients, or attachments
Filing an NPC complaint without first notifying the respondent in writing, unless a provable exception applies
Omitting related cases from the certification against forum shopping
Paying a new “processing,” “clearance,” or “deletion” fee to an unverified collector
Sending payment to a personal account without confirming that it is an authorized channel
Assuming harassment makes the underlying debt disappear
Promising payment terms you cannot meet
Threatening or insulting collectors in return
Forwarding defamatory posts so widely that the harm becomes harder to contain
Ignoring an authentic summons or court notice because earlier messages were fake

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office, if eligible, as soon as possible when:

You receive an authentic summons, subpoena, or court pleading
A collector threatens or attempts physical harm
Intimate images, IDs, medical information, or other highly sensitive data are exposed
Your identity or accounts have been used for unauthorized transactions
The harassment reaches your employer and threatens your livelihood
You are being asked to sign a restructuring, waiver, settlement, confession of judgment, or new promissory note
The lender disputes that the collector works for it
Several agencies or court cases involve the same events
You need damages, an injunction, or another remedy beyond an administrative complaint
A filing deadline or possible criminal prescriptive period may be approaching

Frequently asked questions

Can an online lender contact my family or employer?

Not merely to shame you or pressure them into paying. Contact with third parties about the debt is tightly restricted. Under current NPC guidance, debt collection may be directed to a person who expressly agreed to be a guarantor, not indiscriminately to people found in your contact list. A fact-specific exception may apply to a properly authorized representative, co-maker, or lawful legal process.

Is a character reference responsible for my loan?

No—not solely because the person was named as a reference. A guarantor must separately and expressly agree to assume responsibility if the borrower defaults.

Can the app access all my contacts because I tapped “Allow”?

Not automatically. Consent must be valid, and processing must still be transparent, for a legitimate purpose, and proportionate. Unbridled harvesting or use of contacts for harassment or collection from non-guarantors is prohibited. Deceptive interface design may also undermine the validity of consent.

May a collector threaten to have me arrested for nonpayment?

A collector may truthfully explain lawful remedies but may not threaten an action that cannot legally be taken or use false claims of arrest to intimidate you. Ordinary failure to pay a debt is generally a civil matter, although separate fraudulent acts or violations of special laws may have criminal consequences. Obtain advice based on the actual documents and facts.

Will an SEC or NPC complaint erase my debt?

No. The complaint concerns the lender’s conduct or data processing. The validity, balance, interest, and enforceability of the loan may require a separate contractual or court determination.

Should I keep paying while a complaint is pending?

A complaint does not by itself suspend the loan. Pay only through a verified official channel, request a receipt, and preserve proof. If you dispute the balance or terms, state the dispute in writing and seek legal advice before signing or paying under a new arrangement.

Can I demand deletion of all my data?

You may request blocking, erasure, or destruction where the legal requirements are met, but the right is not absolute. The lender may retain data still necessary for the loan, regulatory compliance, fraud prevention, or legal claims. It should explain the basis and retention period.

Can I file with more than one agency?

Yes, when different conduct falls within different agencies’ authority—for example, unfair collection with the SEC, privacy violations with the NPC, and threats with law enforcement. Disclose related filings whenever a form or certification requires it, and avoid inconsistent factual statements.

Official legal and procedural sources

This article provides general legal information, not advice for a particular case. Procedures and remedies depend on the lender’s regulator, the documents, and the exact conduct involved. Official sources were checked as of 2 September 2026; confirm current forms, addresses, fees, and filing channels with the relevant agency before submitting a complaint.