Quick answer

You can report an online lending app to the Securities and Exchange Commission (SEC) for abusive collection practices and to the National Privacy Commission (NPC) for unlawful use or disclosure of personal data. Threats, fraud, impersonation, doxxing, or other possible crimes should also be reported promptly to the police or a cybercrime unit.

Before blocking collectors or uninstalling the app, preserve the messages, call records, posts, permissions, loan documents, and other evidence. Send the lender a written complaint demanding that the harassment and unauthorized processing stop. For a formal NPC complaint, the general rule is that you must first notify the lender or other responsible entity in writing and allow 15 calendar days from its receipt for an appropriate response, unless the NPC waives this requirement because of serious or urgent circumstances.

Reporting abuse does not automatically cancel a valid loan or suspend lawful collection. A lender may demand payment and pursue proper legal remedies, but it may not use threats, deception, public shaming, or other prohibited methods.

What collectors are not allowed to do

Under the Financial Products and Services Consumer Protection Act, financial service providers must treat consumers fairly and respectfully and must not employ abusive collection or debt-recovery practices. SEC-regulated lending and financing companies, including their collection service providers, are also covered by SEC Memorandum Circular No. 18, Series of 2019.

Conduct that may be prohibited includes:

Threatening violence, property damage, reputational harm, or another criminal act.
Threatening an arrest, prosecution, lawsuit, barangay action, or other measure that the collector cannot legally take or does not genuinely intend to pursue.
Using obscenities, insults, degrading language, or communications intended to abuse or humiliate.
Pretending to be a lawyer, police officer, court employee, government official, or another person.
Using false or deceptive claims about the amount, status, or consequences of a debt.
Publishing or threatening to publish the borrower’s name, photograph, personal information, or alleged failure to pay for the purpose of shaming the borrower.
Telling relatives, friends, co-workers, employers, or unrelated contacts about the loan when no lawful basis permits the disclosure.
Contacting people from the borrower’s contact list for collection when they are not guarantors.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless an exception in the SEC rule applies—such as when the account has been past due for more than 15 days or the borrower has expressly agreed, through written, electronic, or recorded means, that those are the only convenient times. This exception does not permit threats, deception, shaming, or other abusive conduct.

A collector may identify the lender, state the amount allegedly due, request payment, offer restructuring, or pursue a legitimate civil remedy. Firm collection is not automatically harassment; the content, frequency, timing, recipients, and purpose of the communications matter.

When collection becomes a privacy violation

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate to that purpose. Consent to use an app is not unlimited permission to harvest or misuse everything on a phone.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, possible violations include:

Requiring unnecessary access to contacts, photographs, social-media accounts, email lists, location information, or other device data.
Collecting or using more personal data than reasonably necessary for a stated, lawful purpose.
Using a borrower’s photograph to embarrass or pressure the borrower.
Copying or processing a contact list in an unconstrained, excessive, or disproportionate manner.
Using contact information to harass the borrower or people who did not take out the loan.
Continuing to access a camera or photo gallery after identity verification, payment verification, or another stated purpose has been completed.
Keeping data longer than necessary, except when retention remains necessary for the loan, legal claims, or another legal requirement.
Failing to explain what data is being collected, why it is needed, who will receive it, and how long it will be retained.
Disclosing loan information or personal data without a lawful basis.

The government’s March 2026 joint advisory on online lending platforms expressly reiterates that unnecessary permissions, excessive contact-list processing, harassment, and collection outside the borrower’s guarantors are prohibited.

Revoking a permission prevents further access through that permission, but it may not erase data the app has already copied. A written access, objection, correction, blocking, or erasure request may therefore still be necessary. Erasure is not absolute: the lender may retain information required to administer an existing loan, comply with law, or establish, exercise, or defend legal claims.

Character references are not automatically guarantors

A character reference may be contacted only for identity or information verification. The lender must tell that person that they were named as a reference, explain how the contact details were obtained, and provide an option to have the data removed as a character reference.

A guarantor is different. A person becomes a guarantor only by expressly consenting to undertake the borrower’s obligation in accordance with applicable law. Merely appearing in the borrower’s phone, receiving a collection call, or being named as a character reference does not make someone liable for the loan.

For debt collection, the lender may contact a properly consenting guarantor. It may not contact other people in the borrower’s contact list to pressure or shame the borrower.

Preserve evidence before securing the phone

Save evidence as soon as possible because posts, accounts, app listings, and messages can disappear.

Keep copies of:

Complete screenshots showing the sender, number or username, date, time, and entire message thread.
Screen recordings of disappearing messages, account pages, posts, comments, and app permissions.
Call logs, voicemails, recordings lawfully made or received, and notes stating what was said during each call.
URLs and screenshots of public posts, group messages, altered photographs, fake notices, or profile pages.
The app’s name, icon, version, developer, download-page URL, privacy notice, permissions, and support details.
The lender’s corporate name, SEC registration or authority details, collection-agency name, and the identity claimed by each collector.
The loan agreement, disclosure statement, repayment schedule, statements of account, receipts, and proof of every payment.
Names of relatives, friends, employers, or other contacts who received messages, together with copies of what they received and, where possible, their written accounts.
Your written complaint to the lender, proof of delivery, ticket number, acknowledgment, and response.
Payment instructions, recipient account names and numbers, and communications demanding payment to a personal or unfamiliar account.

Keep the original files and a backup outside the affected phone. Avoid cropping, editing, annotating, or forwarding the only copy. Record the events in chronological order while the details are fresh.

After preservation:

Revoke unnecessary contact, camera, photo, location, storage, microphone, and social-media permissions.
Change passwords for email, banking, e-wallet, and social-media accounts if compromise is possible.
Enable multi-factor authentication and review active sessions.
Warn affected contacts not to engage, disclose information, click links, or send money.
Report impersonating accounts or abusive posts to the relevant platform.
Uninstall the app only after preserving the information you may need.

Send a written notice to the lender

Send the complaint to the lender’s official consumer-assistance channel, support address, and data protection officer if identified in its privacy notice. Do not rely only on a phone call.

Your notice should include:

Your name and loan or account reference.
The app and lender involved.
A dated description of each threat, disclosure, contact-list incident, or other objectionable act.
The numbers, accounts, collectors, or collection agency involved.
A statement that you dispute any inaccurate amount or information.
A demand to stop threats, public shaming, and communications with non-guarantors.
A request to remove unlawful posts and correct false information.
A request for the identity of the personal information controller and its data protection officer.
A request for access to the personal data collected, its sources, purposes, recipients, and retention period.
A request to block or erase data that was unlawfully obtained, unlawfully used, or no longer necessary, subject to lawful retention requirements.
A demand that relevant records be preserved for regulatory or legal proceedings.
A request for a written response.

For NPC purposes, keep proof showing when the responsible entity received the notice. The ordinary 15-calendar-day period runs from receipt, not merely from the date you sent it.

Where to report

Concern	Where to report	Important point
Unfair collection by a lending or financing company	SEC iMessage, under the Financing and Lending Companies Department	Attach the loan records, messages, contact-list evidence, internal complaint, and response.
Unauthorized collection, access, use, disclosure, or retention of personal data	National Privacy Commission	A formal complaint ordinarily requires prior written notice and either an inadequate response or no response within 15 calendar days.
Threats, impersonation, extortion, fraud, doxxing, or other possible crimes	Police, PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline	Do not wait for the SEC or NPC process when safety, disappearing evidence, or an ongoing crime is involved.
Complaint against a bank, digital bank, e-money issuer, or another BSP-supervised institution	The institution’s consumer-assistance mechanism, then BSP Consumer Assistance	BSP escalation is generally a second-level remedy after first reporting to the institution.

Filing with the SEC

Submit a complaint through SEC iMessage and choose the service for the Financing and Lending Companies Department. The March 2026 government advisory also lists the SEC hotline as 1-4732 (1-4SEC).

Identify both the app and the corporation behind it. If you do not know the corporation, include the app-store developer, website, privacy notice, payment recipient, support address, and any corporate or certificate numbers displayed in the app.

An app’s absence from official records is relevant, but it does not make harassment safe or lawful. Report the conduct even when the operator’s true identity is uncertain.

Filing a privacy complaint with the NPC

Under the NPC Rules of Procedure, as amended, a formal complaint ordinarily will not be given due course unless you establish that:

You informed the responsible entity in writing about the privacy violation or personal-data breach; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice.

The NPC may waive these requirements for good cause or a serious violation, including circumstances involving grave and irreparable damage, the absence of a plain and adequate remedy, or conduct alleged to be patently illegal. If immediate filing is necessary, state clearly why you are asking for a waiver and attach proof of the urgency.

Use the current complaint-affidavit template on the NPC’s formal complaint page. The complaint must be written, signed, verified, and notarized, with the required certification and supporting evidence. It may be submitted in person, by courier, or as a scanned filing through the email channel specified by the NPC. Check the same page for the current form and applicable fee schedule before filing.

A borrower, character reference, guarantor, or unrelated contact whose own personal data was misused may file as the affected data subject. One person does not automatically file for everyone else without the required authority.

Reporting threats, fraud, or other possible crimes

The March 2026 joint advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; telephone (02) 8723-0401 local 7491

The NBI also maintains an online complaint page and provides investigative assistance through its Cybercrime Division. Bring the original device and unaltered evidence if investigators request examination.

Call 911 or seek help from the nearest police station immediately if there is a credible threat of physical harm, stalking, an attempt to enter your home or workplace, or another emergency.

What to ask for in your complaints

State the relief you actually need. Depending on the facts and the agency’s authority, this may include:

An immediate end to abusive communications.
No further contact with non-guarantors.
Removal of public posts or unlawfully disclosed information.
Correction of false loan or personal information.
Disclosure of what personal data was collected and who received it.
Blocking, deletion, or secure disposal of unlawfully processed data.
An investigation of the lender, app operator, collectors, and service providers.
Preservation of collection records, call recordings, access logs, and disclosure records.
Administrative sanctions or referral for possible prosecution where supported by evidence.
A written, itemized statement of the legitimate balance and an official payment or restructuring channel.

Avoid demanding guaranteed arrest, imprisonment, cancellation of the loan, or damages that the receiving agency has no authority to grant. Describe the facts and let the appropriate authority determine the applicable violation and remedy.

Common mistakes that weaken a complaint

Deleting the app, messages, or posts before preserving them.
Submitting isolated screenshots that do not show the sender, date, time, or surrounding conversation.
Naming only the app without identifying the corporation, developer, collector, or payment recipient.
Filing an NPC complaint without the prior written notice or without explaining why a waiver is justified.
Posting unredacted IDs, loan documents, phone numbers, or contact lists publicly.
Paying a collector through a personal account without verifying that the account belongs to the lender.
Assuming that blocking one number preserves all evidence or stops data already copied from the phone.
Treating a character reference as a guarantor without proof of express consent.
Ignoring legitimate court papers because earlier collection messages were abusive.
Assuming that reporting harassment cancels the debt or pauses interest, charges, or a contractual deadline.

The debt and the harassment are separate issues

A borrower can owe money and still be protected from abusive collection and unlawful data processing. Filing a complaint does not, by itself, erase a valid principal obligation, stop all lawful communications, or prevent a lender from filing a proper civil action.

Article III, Section 20 of the 1987 Constitution provides that no person may be imprisoned for debt. This does not prevent proceedings based on a separate alleged crime—such as fraud or a check-related offense—when its distinct legal elements and evidence are present. Collectors should not represent ordinary nonpayment as an automatic arrest or criminal conviction.

If the amount is disputed, request the signed agreement, disclosure statement, complete computation, payment history, interest and fee basis, and proof that the collector is authorized. Continue addressing any undisputed lawful obligation through verified official channels.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if you qualify, or another appropriate legal-aid provider promptly when:

A collector has made a credible threat against you, your family, or your property.
Your photograph, ID, address, workplace, medical information, or other sensitive data has been published.
Someone is impersonating a court, lawyer, police officer, or government agency.
The app appears to have taken over an account, transferred money, or used your identity.
You receive a subpoena, summons, complaint, demand from a verified lawyer, or other genuine official document.
A case has already been filed or a legal deadline is running.
Several lenders or collectors are involved and the evidence is extensive.
You want to pursue damages or criminal charges.
The lender disputes that the collector acted on its behalf.
The harassment has caused serious safety, employment, medical, or mental-health consequences.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. An app may have limited access necessary to let you select a reference or guarantor or to derive proportionate metadata for a specified legitimate purpose, but unconstrained harvesting and debt-collection contact with people who are not guarantors are prohibited.

Can collectors call my employer or relatives?

Not merely to embarrass you or pressure them into paying. Whether a particular communication is lawful depends on the person’s role, the information disclosed, and the purpose. A valid guarantor may be contacted; a character reference may be contacted for verification, not debt collection.

Does agreeing to the app’s permissions make the conduct legal?

Not automatically. Consent must be informed, freely given, specific, and compatible with the principles of transparency, legitimate purpose, and proportionality. Deceptive interfaces, unnecessary permissions, or excessive processing may make purported consent defective.

Should I wait 15 days before reporting threats?

No. The 15-day rule generally concerns the prior-notice requirement for a formal NPC complaint. It does not prevent an immediate SEC report, platform report, police or cybercrime complaint, or emergency request. The NPC may also waive prior exhaustion in serious cases.

Can I demand deletion of all my data immediately?

You may request blocking or deletion of unlawfully obtained, unauthorized, inaccurate, or unnecessary data. However, a lender may retain information still required to administer a valid loan, comply with law, or handle legal claims. Ask it to identify the lawful basis and retention period for anything it refuses to delete.

I am only a character reference. Can I complain?

Yes, if your personal data was misused or you were harassed. You may also demand removal as a character reference. Being listed as a reference does not make you a guarantor or borrower.

Will the SEC or NPC recover money or cancel the loan?

Not automatically. Their principal roles concern regulatory compliance, consumer protection, and data privacy. Refunds, damages, cancellation, or adjustment of a loan depend on the governing documents, the evidence, the relief requested, and the authority of the agency or court handling the matter.

Official legal and reporting sources

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the loan documents, communications, identities of the parties, evidence, and applicable regulator. Official sources and reporting channels were checked on 4 August 2026.