Quick answer

Online lenders may demand payment through lawful, respectful means, but they may not threaten, intimidate, publicly shame, impersonate authorities, misuse your photo, or indiscriminately contact people in your phonebook. Contacting a borrower’s character references, relatives, coworkers, or other contacts to collect the debt is prohibited unless the person is an actual guarantor who separately and expressly agreed to guarantee the loan.

Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission (SEC). Report unauthorized access, disclosure, or misuse of personal data to the National Privacy Commission (NPC). Threats, extortion, fraud, identity misuse, or other possible crimes may also be reported promptly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.

A complaint does not automatically erase a valid loan. The borrower should dispute incorrect charges in writing and, if money is genuinely due, request an official statement of account and arrange payment only through verified company channels.

What online lenders are prohibited from doing

The Financial Products and Services Consumer Protection Act guarantees financial consumers fair treatment, data privacy, transparent disclosure, and timely complaint handling. It expressly prohibits financial service providers from using abusive collection or debt-recovery practices. Providers may also be responsible for the conduct of their employees, agents, and accredited third-party collection services.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited collection conduct includes practices such as:

Threatening violence, physical harm, property damage, or other criminal acts;
Threatening action that cannot legally be taken;
Using insults, obscenities, or abusive language;
Falsely representing that the collector is connected with a court, police agency, government office, or credit-information agency;
Making false or deceptive statements to force payment;
Publicly disclosing or publishing a borrower’s personal information to shame or humiliate the borrower;
Communicating with people in the borrower’s contact list in a manner prohibited by privacy and collection rules; and
Using unreasonable collection methods, including communications at prohibited or plainly inconvenient times, subject to the exceptions stated in the SEC rules.

A lender may truthfully explain available civil remedies, send a legitimate demand, negotiate payment, or file an appropriate case. Harassment does not become lawful merely because the borrower is late.

Contact-list access and privacy violations

The principal privacy rules are NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02.

These rules apply to lending and financing companies, entities acting as lenders—even if they lack SEC authority—and their collection agencies or other personal-information processors.

An online lending application must not require unnecessary or excessive permissions. Access to a camera, photo gallery, contacts, or other protected phone resources must be suitable and necessary for a specified legitimate purpose. When that purpose has been completed, the borrower should be prompted to revoke or disable the permission.

Limited contact-list processing may be permitted for a legitimate and proportionate purpose, such as allowing the borrower to select a reference or guarantor or deriving proportionate metadata. It does not authorize unrestricted copying, harvesting, or use of the borrower’s contacts for collection or harassment.

In particular:

Unconstrained, excessive, or disproportionate processing of a contact list is prohibited.
A character reference is generally supplied to verify the borrower’s identity or information. A reference is not automatically a guarantor.
A person becomes a guarantor only by expressly consenting to undertake the borrower’s obligation in accordance with the law on guaranty.
For debt collection, the lender may contact the borrower and an actual guarantor. It may not contact other people in the borrower’s phonebook merely to pressure or embarrass the borrower.
A borrower’s photograph must not be edited, posted, circulated, or otherwise used to harass or shame the borrower.
Personal data should be retained only for as long as necessary for the purpose for which it was collected, for legal claims, or as otherwise required by law.

The DICT, NPC, and SEC reaffirmed these restrictions in their March 18, 2026 Joint Advisory on Online Lending Platforms.

What to do immediately

1. Preserve the evidence before blocking or uninstalling the app

Save evidence in its original form whenever possible:

Screenshots and screen recordings showing the complete conversation;
The sender’s phone number, account name, profile, email address, and messaging-platform details;
Dates and exact times of calls, texts, posts, and messages;
Voicemail and call recordings lawfully obtained;
Links, usernames, group names, and screenshots of public-shaming posts;
Messages sent to relatives, friends, coworkers, employers, or clients;
Copies of altered photographs, fabricated notices, or fake arrest and court threats;
The app’s name, download page, developer, privacy notice, requested permissions, and customer-service details;
Loan agreement, disclosure statement, promissory note, repayment schedule, receipts, and statement of account;
Proof of the amount actually received and every payment made;
The collector’s claimed company, agency, employee name, and authority;
Your written complaints to the lender and its replies; and
Statements or affidavits from people who received collection messages.

Do not preserve only cropped screenshots if the surrounding conversation identifies the sender or explains the context. Back up the files to another device or secure account.

2. Secure the phone and accounts

After preserving evidence:

Review and revoke unnecessary permissions for contacts, photos, storage, camera, microphone, location, and social media;
Change passwords if the app or collector may have obtained account credentials;
Enable multifactor authentication;
Check active sessions on email, social media, and financial accounts;
Tell affected contacts not to respond, send money, disclose information, or open links;
Report impersonation or abusive content to the relevant messaging or social-media platform; and
Uninstall the app if it is no longer needed, but only after preserving the agreement, transaction history, privacy notice, and evidence.

Revoking permission may stop future access but cannot by itself retrieve information already copied or disclosed.

3. Send a written complaint to the lender

Use the lender’s official consumer-assistance or data-protection channel. State:

Your name and loan or account reference;
The collector’s identity or number, if known;
What happened, when, and who received the communication;
What personal data was accessed, used, or disclosed;
Why the conduct is disputed;
The corrective action requested; and
A reasonable request that all relevant records, call logs, instructions, and collector assignments be preserved.

You may demand that the company:

Stop contacting persons who are not valid guarantors;
Stop public disclosure, threats, and abusive communications;
Identify the company and collection agency responsible;
Explain where it obtained the affected personal data;
Restrict or delete improperly collected data, subject to lawful retention requirements;
Correct inaccurate account information;
Provide the privacy notice, loan documents, disclosure statement, and itemized statement of account; and
Confirm its response in writing.

For an NPC complaint, this written notice is especially important. Under the 2021 NPC Rules of Procedure, a complainant generally must first notify the responsible entity in writing and allow it to take appropriate action. Ordinarily, the complaint should show that the entity failed to respond or act appropriately within 15 calendar days from receipt. The NPC may waive this requirement for good cause or in serious cases involving grave or irreparable harm, lack of an adequate remedy, or patently illegal conduct.

Where to report the lender

SEC: unfair debt collection by lending or financing companies

For harassment, intimidation, deceptive collection, public shaming, or other unfair practices by an SEC-regulated lending or financing company, submit a complaint through the SEC iMessage portal.

The SEC’s current guidance directs complaints concerning unfair debt collection to its Financing and Lending Companies Department. The SEC’s complaint guidance instructs complainants to provide complete information, attach supporting evidence and a valid government-issued ID, and file one complaint form for each respondent company.

Identify the corporation behind the app—not merely the app’s brand name. Attach, when available:

The loan and disclosure documents;
Proof of disbursement and payments;
Screenshots, messages, call logs, and posts;
Communications received by third parties;
Your prior written complaint and the company’s response; and
Information connecting the app or collector to the respondent company.

The SEC may investigate and impose administrative or regulatory sanctions where warranted. A regulatory complaint, however, does not by itself cancel the loan, rewrite the contract, or conclusively determine every private claim.

NPC: unauthorized processing or disclosure of personal data

File with the NPC when the complaint concerns matters such as:

Copying or harvesting contacts without a proper basis;
Contacting non-guarantors for debt collection;
Disclosing the loan to relatives, coworkers, employers, clients, or the public;
Using or circulating a borrower’s photograph for humiliation;
Excessive permissions or deceptive consent interfaces;
Refusing to explain how personal data was obtained or used;
Continuing unnecessary processing after the relevant purpose has ended; or
Failing to protect personal data from unauthorized access or disclosure.

The NPC’s formal complaint instructions require the prescribed complaint form to be completed, printed, signed, notarized, and submitted personally, by courier, or by scanned email using the filing address shown on the NPC page. Check the linked NPC schedule for the applicable filing fee and any exemption or waiver.

A formal complaint should generally include:

The identities and contact details of the complainant and respondent;
A verified narration of material facts;
The specific privacy acts or omissions complained of;
Documentary evidence and supporting affidavits, when available;
The relief requested;
Copies of prior correspondence with the respondent;
Proof of the respondent’s action, non-action, or failure to respond within 15 calendar days; and
A sworn certification against forum shopping.

If a representative files for the data subject, a special power of attorney is generally required. Failure to comply with the required form and contents can result in dismissal, although the NPC retains authority to act on sufficiently serious or actionable information.

BSP, CDA, or another regulator

The proper financial regulator depends on the provider:

Complaints against banks, digital banks, e-wallet issuers, and other BSP-supervised institutions generally go through the institution’s consumer-assistance mechanism first and may then be elevated through the BSP Consumer Assistance Mechanism.
Complaints involving lending cooperatives may fall within the Cooperative Development Authority’s jurisdiction.
Insurance-related credit products may involve the Insurance Commission.

The app’s branding is not conclusive. Verify the legal entity named in the agreement, disclosure statement, privacy notice, payment instructions, and app-store listing.

When to report to cybercrime authorities

Do not wait for the SEC or NPC process if the messages involve an immediate safety risk, extortion, fraud, account takeover, identity misuse, or a credible threat of violence.

The March 2026 government advisory identifies these reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; telephone (632) 8723-0401 local 7491

For an imminent threat, contact emergency services or the nearest police station immediately. Bring the device containing the original messages when making a report, if safe to do so.

Depending on the exact words and conduct, possible criminal issues may include threats, coercion, extortion, unlawful access or processing of personal data, identity-related offenses, defamation, or fraud. Criminal liability is fact-specific. A harsh demand for payment is not automatically a crime, while a disguised threat or fabricated police or court notice may require urgent investigation.

If the collector threatens arrest

A borrower cannot be imprisoned merely for failing to pay a debt. The Constitution prohibits imprisonment for debt.

That rule does not grant immunity for a separate alleged offense, such as fraud or a violation involving a check, if all legal elements are present. A genuine criminal complaint also follows lawful investigation, prosecutorial, and court procedures. A private collector cannot create an arrest warrant, order immediate imprisonment, or truthfully claim that police are already coming when no such lawful process exists.

Ask for the case number, court, prosecutor’s office, or police unit supposedly involved. Verify it independently using official contact details rather than the number supplied in the threatening message.

If the amount being collected is wrong

Dispute the account in writing and request:

The original loan agreement;
The disclosure statement issued before consummation;
The amount actually released;
The interest rate and all fees;
A complete ledger of payments;
The contractual and legal basis of penalties;
The current itemized balance; and
Official payment instructions in the lender’s corporate name.

Do not send payment to an unknown personal account merely because a collector threatens immediate consequences. Confirm the channel with the lender through independently verified contact information.

A privacy or harassment complaint does not suspend an otherwise valid due date unless the lender, regulator, or court grants appropriate relief. If the undisputed principal is payable, obtain legal or financial advice on tendering payment, negotiating terms, or documenting a settlement without waiving disputed claims.

Common mistakes to avoid

Deleting the app, messages, or social-media post before preserving evidence;
Filing only against the app name without identifying the corporation or collector;
Sending a general narrative without dates, numbers, screenshots, or loan records;
Treating a character reference as though that person automatically guaranteed the debt;
Assuming that harassment makes the entire loan automatically void;
Ignoring a real summons, subpoena, demand, or court notice because earlier threats were fake;
Paying a collector’s personal account without verifying authority and obtaining a receipt;
Posting unredacted IDs, contact lists, loan documents, or intimate information publicly;
Threatening or insulting the collector in return;
Filing an NPC complaint without first sending the required written notice, unless facts support a waiver;
Omitting the verification, notarization, certification against forum shopping, or supporting correspondence required for a formal NPC complaint; and
Waiting until evidence disappears or accounts and phone numbers are deleted.

When legal help is urgent

Consult a lawyer promptly when:

The lender posted your identity, photograph, alleged debt, or private messages publicly;
Your employer, clients, family, or many unrelated contacts were messaged;
The collector used intimate images, fabricated accusations, or threats against children or relatives;
There is a credible threat of physical harm;
Money is being demanded through extortion or impersonation;
Your accounts, SIM, email, or identity documents may have been compromised;
You received an authentic summons, subpoena, prosecutor’s notice, or court order;
The lender is unlicensed, cannot be identified, or appears to be operating a scam;
You need urgent NPC relief to prevent grave or irreparable harm; or
You are considering civil damages or criminal proceedings in addition to administrative complaints.

Different remedies have different prescriptive periods and procedural requirements. Under Republic Act No. 11765, claims accruing under that law generally prescribe five years from consummation of the financial transaction or discovery of deceit or nondisclosure, subject to an ultimate ten-year period stated in the law. Other civil, privacy, and criminal claims may follow different periods, so this is not a reason to delay reporting.

Frequently asked questions

Can a lender contact my family or employer?

Not simply to pressure or shame you into paying. For debt collection, current NPC rules permit contact with an actual guarantor who expressly consented to that role. A character reference or ordinary phone contact is not automatically a guarantor.

Limited communication may be lawful for another legitimate reason, but its purpose, content, necessity, and disclosure of personal data matter.

Is allowing contact permission the same as consenting to harassment?

No. Consent must relate to a specified, legitimate purpose and does not authorize excessive processing, public shaming, threats, or collection from non-guarantors. Deceptive interfaces and unnecessarily broad permissions may also undermine the validity of claimed consent.

Can I complain even if I genuinely owe money?

Yes. The legality of collection conduct is separate from whether a debt exists. You may report harassment or privacy violations while addressing any valid balance through lawful channels.

Can my reference be forced to pay?

Not merely because the person was listed as a reference. A guarantor must expressly agree to undertake the obligation. Whether a particular document created an enforceable guaranty depends on its wording, execution, and the applicable Civil Code rules.

Will the SEC or NPC erase my loan?

Not automatically. The SEC complaint process primarily addresses regulatory violations, while the NPC addresses personal-data processing and privacy rights. The validity, amount, or enforcement of a debt may require a separate dispute process, adjudication, or court action.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers, but retain at least one safe written channel with the lender for account notices, dispute resolution, or settlement. Do not ignore authentic legal documents.

What if the lender has changed app names?

Identify every known app name, developer, website, payment account, phone number, collection agency, and corporate name. Attach evidence connecting them. File a separate SEC complaint form for each distinct respondent company when required.

Can someone whose data was taken from my contacts file a complaint?

Potentially, yes. A person whose information was accessed, used, or disclosed is a data subject and may have an independent privacy complaint. That person should preserve the message received and document how the sender connected them to the borrower.

Official sources

This article provides general legal information, not advice for a particular case. Liability and the proper remedy depend on the actual messages, permissions, loan documents, identity of the provider, and evidence. Sources and official filing guidance were checked as of August 26, 2026.