Quick answer

If an online lending app is threatening, insulting, publicly shaming, or contacting people who did not agree to guarantee your loan, preserve the evidence first. Then:

Revoke the app’s unnecessary permissions and secure your accounts.
Send a written complaint to the lender or its data protection officer and keep proof of receipt.
Report unfair collection practices to the Securities and Exchange Commission (SEC).
For misuse or disclosure of personal data, file with the National Privacy Commission (NPC) if the lender does not take appropriate action or does not respond within 15 calendar days. The NPC may waive this waiting requirement for serious or urgent violations.
Report credible threats, extortion, impersonation, account intrusion, or other suspected crimes immediately to law enforcement. Call 911 if anyone is in immediate danger.

Reporting harassment does not automatically cancel a valid loan. Continue to address the legitimate balance through verified, official channels while disputing abusive or unlawful conduct separately.

What collectors are not allowed to do

Under SEC Memorandum Circular No. 18, Series of 2019, financing and lending companies—and collection agencies acting for them—must use reasonable, lawful means. Prohibited practices include:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing borrowers’ names or personal information, except where disclosure is specifically lawful.
Giving other people false loan information or failing to disclose that a debt is disputed.
Using false identities, false representations, or deceptive methods to collect or obtain information.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the Circular’s limited exceptions: the account has been past due for more than 15 days, or the borrower expressly agreed—through written, electronic, or recorded means—that those hours are the only reasonable or convenient time for contact.
Contacting people in the borrower’s phone contacts who were not named as guarantors or co-makers.

Even where the exception on collection hours applies, it does not authorize violence, threats, public shaming, deceptive statements, or disclosure to unrelated contacts.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, also prohibits abusive collection or debt-recovery practices. A financial service provider is responsible for its employees and agents and may be solidarily liable with an accredited third-party service provider involved in debt collection.

What counts as a privacy violation

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate to that purpose. Giving an app access to some information does not authorize unlimited collection, copying, disclosure, or harassment.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

Loan apps must not demand unnecessary permissions or process excessive personal or sensitive personal information.
Access to a camera, photo gallery, contacts, or other protected resources must be suitable, necessary, and limited to a legitimate purpose.
Once the purpose for a permission has been completed, the app should turn off the access or tell the borrower that it may be revoked.
A borrower’s photograph must not be used to harass or embarrass the borrower.
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited, particularly where it leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors.
An app may give the borrower limited access to their contacts to select a character reference or guarantor. It must not freely harvest or copy the whole contact list for collection.
A character reference is not automatically a guarantor. References may be contacted to verify the borrower’s identity and the truthfulness of loan-application information—not to pressure them into paying the debt.
A reference must be told how their information was obtained and must be offered a way to have their data removed as a reference.
A guarantor must separately consent to that legal role. Merely appearing in someone’s contacts or being named as a reference is not enough.

Possible privacy violations include sending a borrower’s photograph, ID, loan balance, accusations, or threatening messages to friends, relatives, co-workers, or social-media contacts without a lawful basis.

What collection activity may still be lawful

A lender may generally:

Contact the borrower through reasonable and lawful means.
Send payment reminders and formal demands.
Contact an actual guarantor or co-maker who legally undertook the obligation.
Use an authorized collection agency or lawyer, subject to privacy and fair-collection rules.
Disclose necessary information when required by a court or authorized government agency.
Submit information to authorized credit-information channels when permitted by law.
File an appropriate civil action to collect an unpaid obligation.

A third-party collector’s involvement is not automatically illegal. However, outsourcing does not free the lender from responsibility for the collector’s conduct.

The Constitution provides that no person may be imprisoned merely for debt. Ordinary failure to pay a loan is generally civil in nature, although separate facts involving fraud or another offense may create criminal exposure. The Supreme Court has distinguished mere nonpayment from estafa in cases such as Gabionza v. Court of Appeals. Do not ignore a genuine court summons, subpoena, or government notice; verify it directly with the issuing office.

Preserve evidence before blocking or uninstalling the app

Save the strongest possible record of what happened:

Full screenshots showing the sender, number or account, date, time, and complete message.
Screen recordings that show the conversation, profile, URL, and surrounding context.
Original SMS, chat exports, emails with headers, voice messages, and call logs.
Social-media posts, comments, profile links, post URLs, and the date and time they were visible.
The app’s store listing, developer name, package or application ID, privacy notice, and requested permissions.
The legal name of the lender shown in the loan agreement, disclosure statement, receipts, privacy notice, or payment instructions.
Loan documents, amortization schedules, account statements, payment receipts, and proof of settlement if already paid.
Collector names, claimed agency names, phone numbers, email addresses, bank or e-wallet accounts, and payment links.
Messages received by relatives, friends, co-workers, employers, references, or other contacts.
Short signed statements from affected contacts describing what they received and when.
Your written complaint to the lender and proof that it was delivered or received.
Any ticket numbers or acknowledgments from the lender, SEC, NPC, app store, social platform, or police.

Keep unedited originals. Cropped screenshots may be useful for illustration, but retain the complete version. Back up the evidence to another trusted device or secure storage before deleting anything.

Secure your phone and accounts

After preserving evidence:

Review the app’s permissions and revoke access to contacts, photos, files, camera, microphone, location, phone, and SMS where no longer necessary.
Uninstall the app if you no longer need it, but only after saving the documents and evidence stored inside it.
Change passwords for your email, social-media, banking, and e-wallet accounts if compromise is possible.
Enable multi-factor authentication and review logged-in devices.
Make social-media contact lists, work details, and tagged posts less visible.
Tell affected contacts not to argue with collectors. Ask them to preserve the message, block the sender after saving it, and avoid clicking payment links.
Never disclose an OTP, PIN, password, complete card number, or account credentials to a collector or government complaint desk.

Revoking permissions does not necessarily erase data already copied by the app. Address retained or disclosed data in your written privacy complaint.

Send a formal written complaint to the lender

Send the complaint to the lender’s customer-service unit and data protection officer using the addresses in the contract, privacy notice, official website, or app listing. Include:

Your name and reliable contact details.
The app’s brand name and the lender’s legal corporate name, if known.
Loan or account reference numbers, with sensitive details partly masked where appropriate.
A chronological account of the collection conduct.
The exact words or threats used, without paraphrasing where the wording matters.
The personal data accessed, copied, used, or disclosed.
The identities of people contacted and whether any of them actually consented as guarantor or co-maker.
Copies of the supporting evidence.
The specific action you want the company to take.

Reasonable requests may include:

Stop contacting people who are not legally bound as guarantors or co-makers.
Stop publishing or disclosing your loan information.
Remove public posts and instruct agents or processors to remove copies.
Identify the company and collector responsible.
Explain the source, lawful basis, purpose, recipients, and retention period for the personal data.
Correct false loan information.
Block, delete, or dispose of data that was unlawfully obtained, is excessive, or is no longer necessary, subject to legitimate legal-retention and claims requirements.
Preserve collection logs, recordings, access records, and internal communications for investigation.
Provide a written response and complaint reference number.

For NPC purposes, keep proof that the company received this written notice. Under the current NPC rules, the company ordinarily has 15 calendar days from receipt to respond or take timely and appropriate action.

Report unfair collection to the SEC

The SEC generally handles complaints against lending companies, financing companies, online lending platforms, and their collection agencies.

Use the current SEC iMessage ticketing portal and select the service for complaints on financing and lending companies. Include:

The app and corporate names.
The collector or collection-agency name, if known.
Loan documents and disclosure statements.
Dates, times, phone numbers, accounts, and exact statements involved.
Evidence of public shaming, threats, deceptive representations, improper contact hours, or contact with unrelated people.
Your prior complaint to the lender and its response, if any.

Keep the SEC ticket number and copies of everything submitted. If you cannot identify the lender, provide the app-store link, developer information, payment-account details, privacy policy, loan documents, and every name used by the collector.

The SEC may investigate regulatory violations, but its official complaint guidance cautions that a regulatory complaint does not itself cancel a loan, rewrite payment terms, or automatically declare the contract or interest void.

File a privacy complaint with the NPC

First satisfy the 15-day requirement

Under the 2021 NPC Rules of Procedure, as amended, a privacy complaint ordinarily will not be given due course unless:

You informed the company or concerned entity of the violation in writing; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive these requirements for properly alleged and proven good cause or a serious violation presenting a risk of harm—for example, grave and irreparable damage that requires NPC action. If ongoing disclosure or harassment makes waiting dangerous, explain the urgency and attach proof when asking for a waiver.

Prepare the complaint correctly

Use the NPC’s current filing page and Complaint-Affidavit form. The form requires, among other things:

Complainant and respondent information.
The personal data involved.
A clear, chronological narration.
The privacy violations alleged.
The relief requested.
Copies of evidence and correspondence.
A valid government-issued ID.
Verification under oath and a certification against forum shopping.

Have the complaint properly notarized. The NPC accepts filings in person, by courier, or by scanning and emailing the completed documents to complaints@privacy.gov.ph, subject to its current filing instructions.

The published NPC schedule of fees lists a ₱500 complaint filing fee and a legal research fee of 1% of the filing fee, but not less than ₱10. Additional fees apply when damages are claimed. Qualified indigent litigants may seek exemption by submitting the required supporting documents. Confirm the current assessment and payment instructions with the NPC before paying.

Failure to identify the respondent as far as reasonably possible, attach evidence, describe the violation, or comply with the required form can result in dismissal without prejudice.

Disclose related complaints

The NPC complaint includes a sworn certification against forum shopping. Do not state that no related case exists if you have filed one. Disclose any SEC, court, or other quasi-judicial proceeding involving the same or similar issues and give its current status.

Different agencies may address different violations, but overlapping formal cases can raise procedural questions. If the claims and requested relief substantially overlap, obtain legal advice before signing the certification.

If the lender is supervised by the BSP

Most stand-alone online lending apps and financing or lending companies fall under the SEC. If the credit provider is a bank, digital bank, non-bank e-money issuer, or another BSP-supervised institution:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.
If the result is unsatisfactory, escalate through the BSP Online Buddy on the BSP website or submit the BSP Complaint/Inquiry/Reply form as directed in the current BSP complaint guide.

The BSP Consumer Assistance Mechanism is a second-level remedy. Include proof that you first complained to the supervised institution.

If a BSP-regulated e-wallet was merely used to receive payment for a loan issued by an SEC-regulated lender, the collection complaint normally belongs with the SEC. A separate unauthorized e-wallet transaction or account issue may belong with the BSP.

When police or cybercrime help is urgent

Do not wait for the lender’s response or the NPC’s 15-day period when there is an immediate safety risk or suspected crime, such as:

A credible threat to kill, injure, abduct, or damage property.
Extortion or a demand for payment to prevent publication of personal or intimate material.
Doxxing that exposes a home, workplace, live location, or children’s information.
Account hacking, identity theft, impersonation, or unauthorized transactions.
Sexual threats or circulation of intimate images.
A collector claiming to be a police officer, judge, court employee, or government official.
An attempt to enter a home or workplace by force.
Persistent conduct that makes physical harm appear imminent.

Call the nationwide Unified 911 Emergency Hotline for immediate danger. Otherwise, report to the nearest police station, the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or the Cybercrime Investigation and Coordinating Center. CICC concerns may also be reported through the government’s 1326 channel; current contact information is available from the DICT.

Bring your device, government ID, chronology, original electronic evidence, loan documents, and information identifying the collector. Ask for a complaint, blotter, or reference number. The investigating agency or prosecutor—not the collector—determines what criminal charge, if any, is supported by the facts.

Common mistakes to avoid

Deleting the app, messages, or account before preserving evidence.
Describing everything only as “harassment” without dates, exact words, recipients, and screenshots.
Naming only the app brand and omitting the corporate lender, developer, collection agency, or payment account.
Sending unredacted IDs or sensitive loan records to unofficial email addresses or social-media accounts.
Paying through a new link, personal account, or e-wallet supplied in a threatening message without verifying it with the lender.
Assuming that contact permission authorizes public shaming or debt collection from everyone in the phonebook.
Treating a character reference as automatically liable for the debt.
Publicly posting accusations or collectors’ personal information in a way that creates separate privacy or defamation issues.
Ignoring a genuine court or government notice because earlier collector messages were fake.
Signing an inaccurate certification against forum shopping.
Stopping all payment solely because a complaint was filed. Dispute harassment and the loan balance through separate, documented channels.

Frequently asked questions

Can a lender contact my family, friends, or employer?

A lender should not disclose your debt or pressure an unrelated person to pay. A character reference may be contacted for limited verification purposes but is not automatically a guarantor. An actual guarantor or co-maker who separately agreed to be legally bound may be contacted.

I allowed the app to access my contacts. Does that make the messages lawful?

No. Permission does not authorize excessive processing, harassment, public disclosure, or collection from people who did not guarantee the loan.

Does filing with the SEC or NPC erase the loan?

No. Regulatory or privacy violations do not automatically extinguish a valid debt. Ask for a verified statement of account and use only official payment channels.

Can a collector have me arrested for not paying?

A collector cannot issue an arrest warrant, and no one may be imprisoned merely for debt. Separate conduct involving fraud or another crime is fact-dependent and must go through lawful investigation and court process.

What if I already paid but the harassment continues?

Preserve the payment receipt, request a complete ledger and written confirmation of closure, and report continued collection or disclosure. Include proof of payment in every complaint.

Must I wait 15 days before going to the NPC?

Ordinarily, yes: first notify the respondent in writing and allow 15 calendar days for an appropriate response. The NPC may waive this requirement for good cause or a serious violation presenting a substantial risk of harm. Police and emergency reports should never be delayed by this rule.

What if I cannot identify the company behind the app?

Report every available identifier: app name, store URL, developer, package ID, website, privacy notice, collector numbers, payment accounts, loan reference, messages, and screenshots. Do not guess a corporate identity.

Can I report the app to Google, Apple, Facebook, or a telecom provider?

Yes, after preserving evidence. Platform and telecom reports may help remove an app, account, post, or abusive number, but they do not replace complaints to the SEC, NPC, BSP, or law enforcement.

Official legal sources

This article provides general legal information, not advice for a specific case. Outcomes depend on the loan documents, the parties’ roles, the evidence, and the precise communications involved. Procedures and contact channels can change; verify them on the linked agency websites before filing. Sources and procedures checked as of 6 August 2026.