Quick answer

You may report an online lending app to more than one authority because harassment and misuse of personal data are separate concerns:

Report unfair collection practices by lending or financing companies to the Securities and Exchange Commission (SEC) through iMessage.
Report unauthorized access, disclosure, public shaming, or misuse of contacts and other personal data to the National Privacy Commission (NPC).
Report threats, extortion, impersonation, fraud, stalking, or danger to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.
If the provider is a bank, e-wallet issuer, pawnshop, or another institution supervised by the Bangko Sentral ng Pilipinas, complain first to that institution and then escalate an unresolved complaint to the BSP Consumer Assistance Mechanism.

Harassment does not cancel a valid loan, but owing money does not give a lender or collector the right to threaten, shame, deceive, or indiscriminately contact people in your phonebook. The Constitution also provides that no person may be imprisoned merely for debt. A creditor may pursue lawful collection or a civil case, while fraud, bounced checks, or other independently unlawful acts may present different issues.

What conduct should be reported?

Report conduct such as:

Threats of violence, arrest, prosecution, property damage, or reputational harm, especially threats to take action that cannot legally be taken
Obscene language, insults, repeated intimidation, or abusive messages
Pretending to be a police officer, lawyer, court employee, government agency, or another person
Publicly posting or sending your name, photograph, identification, loan details, or supposed “wanted” notice to shame you
Contacting your employer, relatives, friends, co-workers, social-media connections, or other phone contacts to pressure or embarrass you
Contacting people listed only as character references to collect the debt
Treating a character reference as a guarantor even though that person never separately agreed to guarantee the loan
Unnecessary or excessive access to contacts, messages, photographs, camera, location, social-media accounts, or other phone data
Continuing to process information after the relevant permission is no longer necessary and no other lawful basis applies
Collection calls before 6:00 a.m. or after 10:00 p.m., subject to the exceptions stated in SEC Memorandum Circular No. 18, series of 2019
Using a false company name, concealing the collector’s identity, or misrepresenting the amount or legal status of the debt
Collecting for an app or lender that appears unregistered or unauthorized

Under the NPC’s loan-transaction rules, processing a borrower’s contact list must not be unbridled, excessive, or disproportionate. An app may obtain only the limited access necessary to let the borrower choose a character reference or guarantor. For debt collection, the lender may contact the borrower and a person who separately and expressly consented to be a guarantor—not everyone stored in the borrower’s phone.

A lender may still send reasonable payment reminders, provide an accurate account statement, negotiate payment, contact an actual guarantor, or pursue remedies allowed by the loan agreement and law. An unpleasant but truthful demand is not automatically unlawful; the words used, timing, frequency, recipients, representations, and handling of personal data all matter.

Protect yourself before deleting anything

Preserve evidence before blocking numbers, revoking permissions, resetting your phone, or uninstalling the app.

Save:

Full screenshots and screen recordings showing the app name, sender, phone number, account, date, and time
Complete message threads, emails, call logs, voice messages, and recordings lawfully in your possession
Social-media posts, comments, group chats, profile links, and URLs
Messages received by relatives, friends, employers, or other contacts
Written statements from contacted persons describing what they received and when
The app’s store page, developer name, website, privacy notice, loan disclosure, permissions screen, and version number
Loan agreement, promissory note, disclosure statement, payment schedule, receipts, and account history
The company’s legal name, business address, customer-service details, collector’s name, and collection-agency details
Proof that you complained to the company or its data protection officer, including delivery and acknowledgment
Any demand for payment to a personal bank or e-wallet account
Any police blotter, medical record, or employer communication resulting from the incident

Do not crop away identifying information unless you also retain an original copy. Export files where possible, keep a backup, and prepare a simple timeline matching each event to its evidence. Avoid publicly reposting IDs, phone numbers, account details, or other people’s personal information while seeking help.

Immediate safety and account-security steps

If a message contains a credible threat of violence, someone is following you, or a collector appears at your home and you feel unsafe, contact local police or emergency services immediately. Do not meet a threatening collector alone.

For digital safety:

Take screenshots of the app’s current permissions.
Revoke unnecessary access to contacts, camera, photos, microphone, location, SMS, and storage through the phone’s settings.
Change passwords for email, social media, and financial accounts if the app or collector may have obtained them.
Enable multi-factor authentication and review active sessions.
Warn contacts briefly that they may receive unauthorized or misleading messages. Ask them not to engage, click links, or send money.
Verify payment instructions using the lender’s official channel. Do not pay a collector’s personal account merely because of a threat.
If you keep using the app to obtain evidence or account information, minimize its permissions and do not upload additional documents unless necessary.

Revoking a phone permission does not itself erase information the company already copied. Send a written privacy request as well.

Send a written complaint to the lender first

Address the complaint to the company’s customer-service unit and data protection officer, if listed. Use email or another channel that creates proof of delivery.

Include:

Your name and loan or account reference, while avoiding unnecessary sensitive information
The app’s name and the lender’s legal name, if known
A chronological description of the conduct
Numbers, accounts, collectors, and collection agencies involved
The personal data accessed, disclosed, or used
Names of people contacted and whether any person actually agreed to be a guarantor
Copies of key evidence
The action you want, such as stopping contact with third parties, correcting the account, identifying the source and recipients of data, restricting unlawful processing, preserving records, and investigating the collector

You may ask the company to explain what personal data it holds, where the data came from, why it was processed, who received it, how long it will be retained, and what lawful basis it relies on. Rights to access, correction, objection, blocking, erasure, or damages depend on the Data Privacy Act and the circumstances. Erasure is not absolute: information may still be retained when necessary for a legal obligation or the establishment, exercise, or defense of legal claims.

For an NPC complaint, written notice to the company is generally important. Under the NPC’s amended Rules of Procedure, the company must be given an opportunity to act; ordinarily, you may proceed if it takes no timely appropriate action or does not respond within 15 calendar days after receiving your written notice. The NPC may waive this requirement for good cause or serious violations, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

Do not wait for that period when there is an immediate safety risk. Contact law enforcement at once.

How to complain to the SEC

The SEC regulates lending and financing companies and their online lending platforms. File through the SEC’s iMessage ticketing system and select the service for complaints concerning financing and lending companies.

State:

The lender’s legal name and the app or platform name
Your loan or account reference
The collector or collection agency involved
The exact acts complained of, including dates, times, recipients, and words used
Whether the app contacted non-guarantors or publicly disclosed loan information
The resolution requested
A list of attachments

Attach readable copies rather than only sending links that may later disappear. Keep the ticket or reference number.

The March 2026 joint government advisory identifies these SEC channels for unfair debt collection:

SEC Financing and Lending Companies Department: imessage.sec.gov.ph
SEC hotline: 1-4732 (1-4SEC)

An SEC complaint can address regulatory violations but does not automatically settle the amount owed, award damages, or stop a court case. Respond promptly to any genuine summons or order issued by a court or government agency.

How to complain to the National Privacy Commission

Use the NPC’s current Complaints-Assisted Form. The NPC instructs complainants to complete the form, have it notarized, attach supporting documents, and submit it:

In person at an NPC office
By courier
By scanning and emailing it to complaints@privacy.gov.ph

Check the NPC page before filing for the current form and applicable fees.

The formal complaint should identify the complainant and respondent; provide their available contact details; narrate the material facts; identify the Data Privacy Act, implementing rules, or NPC issuances allegedly violated; state the relief requested; and attach correspondence with the respondent, documentary evidence, and witness affidavits where appropriate. It must be verified and accompanied by the required certification against forum shopping.

Also include:

Proof that the company received your written privacy complaint
Its response, or proof that 15 calendar days passed without a response
Evidence showing how the app obtained or used the information
Screenshots from people contacted
An explanation of why those people were neither borrowers nor consenting guarantors
A request for waiver of prior-notice requirements, with supporting facts, if urgent harm makes ordinary exhaustion inappropriate

A representative generally needs a special power of attorney. Different proof rules apply when a parent or guardian files for a minor or person alleged to be incompetent. Incomplete, unsigned, unverified, or unsupported complaints may be dismissed, so use the current form carefully.

When to report to cybercrime or law-enforcement authorities

Contact law enforcement when the conduct involves threats, extortion, blackmail, fraud, identity misuse, impersonation, account takeover, stalking, or other suspected crimes. The facts determine which offense, if any, applies; avoid choosing a criminal label based only on a threatening message.

The government’s March 2026 advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Provide originals or reliable copies, the device used, a timeline, sender identifiers, URLs, payment destinations, and witness details. Ask for a reference number or proof of receipt. A report does not guarantee that charges will be filed; investigators and prosecutors must assess the evidence and applicable law.

If the provider is supervised by the BSP

Complaints about ordinary lending companies, online lending apps, and their collection agencies are generally best directed to the SEC. If the financial service provider is a BSP-supervised institution, such as a bank or non-bank electronic-money issuer:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.
If the matter remains unresolved or the response is unsatisfactory, escalate it to the BSP through the BSP Online Buddy and Consumer Assistance channels.
If you cannot use BOB, complete the BSP Complaints, Inquiries and Requests form and email it with proof of your first-level complaint to consumeraffairs@bsp.gov.ph.

Do not send PINs, passwords, one-time passwords, or complete card credentials with a complaint.

Common mistakes that weaken a complaint

Avoid:

Deleting the app or messages before preserving evidence
Reporting only the app’s brand name and not identifying the company behind it
Sending isolated screenshots with no visible sender, date, time, or context
Failing to save messages received by third parties
Filing an NPC complaint without first notifying the company in writing, unless a supported exception applies
Omitting notarization, verification, the certification against forum shopping, or required attachments
Naming a character reference as a guarantor without proof of separate consent
Exaggerating facts or adding allegations that cannot be supported
Ignoring a real court summons because earlier messages were fake
Assuming that blocking a collector, uninstalling the app, or filing a complaint extinguishes the loan
Paying an unfamiliar personal account without independently verifying the recipient
Posting your complaint publicly with IDs, account numbers, contact lists, or other sensitive information exposed

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

You receive an authentic summons, subpoena, warrant, or court order
The lender has filed a case or is trying to seize collateral
A collector threatens or commits physical harm
Intimate images, identity documents, medical information, or children’s data are involved
Harassment has caused job loss, serious reputational injury, or significant financial loss
Someone used your identity to obtain a loan
You are being asked to sign a settlement, waiver, restructuring agreement, or admission you do not understand
You intend to seek damages or pursue criminal charges
Multiple entities—the lender, app operator, collection agency, and individual collectors—may be responsible

Frequently asked questions

Can an online lender contact everyone in my phone?

No. Unconstrained or excessive processing of a contact list is prohibited. For collection, the lender may not contact persons in the list other than those who were declared as guarantors. A guarantor must have separately and expressly agreed to assume responsibility if the borrower defaults.

Can the lender contact my character reference about payment?

A character reference is used to verify identity or information and is not automatically a guarantor. The NPC’s amended rules distinguish the two. Debt-collection contact is limited to a consenting guarantor, not a person who was merely named as a reference.

Is calling my employer or relatives always illegal?

The answer depends on why they were contacted, what was disclosed, whether the person was a genuine guarantor, and whether the processing was necessary and lawful. Contact intended to expose the debt, shame the borrower, or pressure payment through non-guarantors should be documented and reported.

May a collector threaten to have me arrested?

No one may be imprisoned merely for debt. A creditor may use lawful civil remedies, and separate criminal conduct can have separate consequences, but falsely threatening arrest or pretending that arrest is automatic may constitute an unfair collection practice and should be preserved as evidence.

Should I stop paying after filing a complaint?

A complaint does not by itself suspend or erase a valid obligation. Ask for an accurate statement of account, dispute unsupported charges in writing, and pay only through a verified official channel. Obtain a receipt. Seek legal advice before withholding payment if liability or the amount is genuinely disputed.

Can I file with both the SEC and NPC?

Yes, when the facts involve both unfair debt collection and misuse of personal data. A law-enforcement report may also be appropriate for threats, fraud, or other suspected crimes. Tell each authority about related proceedings when its forms or rules require disclosure.

Must I wait 15 days before going to the NPC?

Ordinarily, you should first notify the company in writing and allow it 15 calendar days from receipt to respond or take appropriate action. The NPC may waive this requirement for good cause or a serious violation. Immediate danger should be reported to law enforcement without delay.

What if I never borrowed from the app?

State that clearly in every report. Preserve messages, check whether your identity or number was used without authority, demand the loan application and basis for associating you with the account, and consider an immediate privacy and cybercrime report.

What if the app is no longer available in the app store?

You may still report it. Preserve the package or app name, developer, website, advertisements, installation source, phone numbers, payment accounts, messages, and any loan documents. Identify the legal entity if possible, but explain the available identifying circumstances if its identity remains unknown.

Official legal and filing sources

This article provides general legal information, not advice for a particular case. Procedures and legal consequences may depend on the lender’s regulatory status, the loan documents, the data processed, and the exact communications involved. Official sources and filing channels were checked as of August 2, 2026.