Quick answer

If an online lending app is threatening, insulting, publicly shaming, repeatedly contacting people who did not guarantee the loan, or misusing your contacts, photos, messages, or other personal data:

Preserve the evidence before blocking numbers, changing permissions, or uninstalling the app.
Send a written complaint to the lender or its data protection officer.
Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission (SEC).
File a separate privacy complaint with the National Privacy Commission (NPC) when personal data was unlawfully accessed, used, or disclosed.
Report threats, impersonation, fraud, extortion, or immediate safety risks to the police, NBI, or DICT without waiting for the lender to respond.

These remedies can be pursued at the same time when the facts overlap. Filing a complaint does not automatically cancel a valid loan, but owing money does not authorize harassment, public shaming, unlawful threats, or misuse of personal data.

What online lenders are not allowed to do

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act, prohibits abusive collection or debt-recovery practices and requires financial service providers to treat clients fairly, protect client data, and maintain a free consumer-assistance mechanism. A provider is generally responsible for the conduct of its employees, agents, and accredited third-party collectors. Read Republic Act No. 11765.

SEC Memorandum Circular No. 18, series of 2019, identifies unfair practices by financing companies, lending companies, and their third-party collection providers. Report conduct such as:

Threatening violence, property damage, arrest, or another action that cannot legally be taken;
Using obscene, insulting, degrading, or shaming language;
Publishing or threatening to publish a borrower’s name or debt to humiliate the borrower;
Giving false credit information or failing to disclose that a debt is disputed;
Pretending to be a lawyer, police officer, court employee, government official, or another person;
Using deception to collect a debt or obtain information;
Contacting people in the borrower’s phonebook who were not named as guarantors or co-makers;
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions, including when the account has been overdue for more than 15 days or the borrower expressly permits those times as the only reasonable or convenient opportunities for contact.

Consent to ordinary collection does not permit threats or humiliation. In particular, the government’s March 2026 joint advisory reiterates that persons in a borrower’s contact list may not be contacted for debt collection unless they are guarantors. See the SEC’s official page for Memorandum Circular No. 18 and the DICT–NPC–SEC advisory on online lending platforms.

When access to personal data becomes a privacy violation

The Data Privacy Act requires personal data to be processed fairly, lawfully, transparently, and only to the extent necessary for a declared and legitimate purpose. Data subjects have rights to information, access, correction, blocking or removal in appropriate cases, damages, and the filing of an NPC complaint. Read the Data Privacy Act.

A lending app may have a lawful reason to process information needed to verify identity, evaluate a loan, administer the account, comply with law, or pursue legitimate legal claims. Access is not automatically unlawful merely because the app requested a device permission. The purpose, amount of data, notice, lawful basis, and actual use all matter.

Red flags include:

Copying or using an entire contact list without a necessary and proportionate purpose;
Contacting relatives, friends, co-workers, employers, or other phone contacts to disclose the debt or pressure the borrower;
Accessing photos, files, location, messages, call logs, social-media information, or device data unrelated to a legitimate loan-processing purpose;
Using a borrower’s photo, ID, profile, or loan details in a public-shaming post;
Continuing unnecessary access after identity verification or another stated purpose has been completed;
Giving personal data to collectors or other third parties without a proper basis and safeguards;
Concealing how data will be used, using pre-ticked permissions, or making consent easy to give but difficult to withdraw;
Refusing to identify the source, purpose, recipients, or retention period of personal data;
Failing to correct inaccurate data or continuing to process data that was unlawfully obtained or used for an unauthorized purpose.

Limited contact-list access may be allowed to let a borrower select a character reference or guarantor, or to derive proportionate metadata where necessary for a specified legitimate purpose. Unrestricted or excessive processing is prohibited.

A character reference is not automatically a guarantor. A lender may contact a character reference to verify the applicant’s identity or information, but not to collect the debt. A guarantor must separately and expressly agree to assume responsibility if the borrower defaults. Read NPC Circular No. 2022-02.

Preserve evidence before taking action

Keep the original electronic evidence, not just cropped screenshots. Save:

The app’s name, icon, download page, developer, package name, website, and advertised company name;
The lender’s corporate name, SEC registration number, Certificate of Authority number, address, and customer-service or data-protection contact;
The loan agreement, disclosure statement, repayment schedule, account statement, and collection policy;
Proof of disbursement, payments, balances, and any disputed charges;
Complete screenshots showing the message, sender, phone number or account, date, and time;
Chat exports, emails with headers, voicemail files, call logs, social-media URLs, and copies of public posts;
Screenshots of the app permissions, privacy notice, consent screens, and settings;
Names of relatives, co-workers, employers, or other people contacted, together with their screenshots and written accounts;
Every complaint sent to the lender and proof of delivery or receipt;
The lender’s response, ticket number, and any promise to stop, delete, correct, or investigate.

Keep unedited originals and make backups in a secure location. Write a short chronology listing each incident, the date and time, who was involved, what information was disclosed, and how it affected you.

Do not secretly record a private telephone conversation without legal advice. Republic Act No. 4200 generally requires authorization from all parties to record a private communication. Save existing messages, call logs, and voicemails instead, or ask for consent before recording. Read the Anti-Wiretapping Act.

Secure your phone and accounts

After preserving the evidence:

Revoke unnecessary permissions for contacts, storage, photos, camera, microphone, location, SMS, and call logs.
Take screenshots confirming when permissions were revoked.
Uninstall the app if it is no longer needed or appears unsafe. Uninstalling does not delete information already copied to the lender’s systems.
Change passwords that were reused elsewhere and enable multi-factor authentication.
Warn affected contacts not to send money, disclose information, or follow links from collectors.
Check email, bank, e-wallet, and mobile accounts for unauthorized activity.
Do not send an OTP, PIN, password, full card number, or additional ID merely because a collector demands it.
Do not publicly upload your loan agreement or government ID when asking for help. Redact information that is not needed.

Complain to the lender in writing

Use the lender’s official consumer-assistance channel and, for privacy issues, its data protection officer. The app’s privacy notice, loan agreement, website, or disclosure statement should contain these details.

Your complaint should state:

Your name and account or loan reference;
The app brand and legal company name;
The dates and exact acts complained of;
The collector’s number, account, or claimed identity;
The people contacted and information disclosed;
The device data or permissions involved;
Whether you dispute the debt, balance, fees, or identity of the borrower;
The action you want the company to take.

You may request that the company:

Stop threats, insults, public shaming, and contact with non-guarantors;
Restrict future collection communications to an appropriate written channel;
Identify the collector and confirm whether the person is its employee or agent;
Identify what personal data it holds, the source, purposes, recipients, and retention period;
Correct inaccurate account or personal information;
Block, remove, or securely dispose of unlawfully obtained or no-longer-necessary data, subject to lawful retention and legal-claim requirements;
Notify recipients of corrected information where appropriate;
Preserve relevant collection, access, disclosure, and audit logs;
Give a written response and complaint reference number.

For an eventual NPC complaint, keep proof that the lender received your written notice. The NPC ordinarily expects the organization to be informed first and given an opportunity to act.

File an SEC complaint for unfair collection

For a non-bank online lending platform operated by a lending or financing company, submit the complaint to the SEC Financing and Lending Companies Department.

The SEC and the March 2026 joint advisory direct complainants to the SEC iMessage ticketing system. The current process is:

Register or sign in through eSECURE.
Select “Open A New Ticket.”
Search for the Financing and Lending Companies Department service.
Select “Complaints on Financing and Lending Companies.”
Identify the company, describe the conduct chronologically, and upload the supporting evidence.
Save the electronic ticket number and monitor the ticket for requests or replies.

The SEC iMessage user guide explains account registration, ticket creation, attachments, replies, and status tracking. The SEC hotline listed in the joint advisory is 1-4732 (1-4SEC).

Use the company’s legal name, not only the app brand. Check registration and authority through Check with SEC. A corporate registration alone does not necessarily mean the company has authority to operate a lending or financing business or that every app it uses is recorded with the SEC.

If several apps are operated by the same company, identify each app. If different companies are involved, separate the allegations and evidence by respondent.

File an NPC complaint for misuse of personal data

First notify the lender

Under the 2021 NPC Rules of Procedure, as amended, a formal complaint generally will not be given due course unless:

You informed the lender, collector, personal information controller, or other concerned entity of the privacy violation in writing; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving your written notice.

The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm that only NPC action can prevent or mitigate, the absence of a plain and adequate remedy, or a patently illegal act. Explain the urgency and attach proof instead of merely stating that the case is serious.

Prepare the formal complaint

Use the NPC’s official complaint form. The complaint must generally be:

In writing, signed, verified, and notarized;
Clear about the complainant’s and respondent’s identities and contact details;
Supported by a factual chronology and documentary or testimonial evidence;
Specific about the relief requested;
Accompanied by correspondence with the respondent and proof of the respondent’s action or failure to act;
Accompanied by a certification against forum shopping;
Supported by the required authority if filed through a representative.

A person whose number was taken from someone else’s phone and used for harassment may file as an affected data subject. The complainant need not be the borrower if the complainant’s own data was processed or disclosed.

The NPC’s formal-complaint page provides the current form and instructions. It directs complainants to print and complete the form, have it notarized, and submit it personally, by courier, or by scanning and emailing it to complaints@privacy.gov.ph. Check the NPC homepage before a personal or courier filing because its physical office has relocated.

The current base filing fee is ₱500, with other fees potentially applying to claims for damages, legal research, or specific applications. Qualified indigent complainants may seek an exemption by submitting the required proof. Review the NPC schedule of fees and obtain official payment instructions before paying.

When the BSP is the correct regulator

The Bangko Sentral ng Pilipinas is generally the correct financial regulator when the lender is a BSP-supervised institution, such as a bank or another institution under BSP supervision. An ordinary SEC-licensed lending company does not become BSP-supervised merely because it disburses or collects money through a bank or e-wallet.

For a BSP-supervised institution:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel.
If the response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism.
Use the BSP Online Buddy on the BSP website, or submit the prescribed form and proof of the institution-level complaint to consumeraffairs@bsp.gov.ph.

The BSP describes its mechanism as a second-level recourse and explains the requirements in its current complaint guide and consumer-assistance page.

Report threats, fraud, or cybercrime immediately

Do not wait 15 days if there is a threat of violence, extortion, impersonation, account takeover, an unknown loan made in your name, or another immediate security risk. Preserve the evidence and contact the appropriate authority.

The March 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

If someone is in immediate physical danger, contact emergency services or go to the nearest police station. Tell trusted family members or your employer’s security office if a specific threat concerns your home or workplace.

Threats, impersonation, public posts, or demands for money may have criminal implications depending on the exact words, intent, medium, and surrounding facts. Let law-enforcement officers or a lawyer assess the proper offense rather than labeling every hostile message as a particular crime.

Common mistakes that weaken complaints

Deleting the app, messages, or posts before saving evidence;
Filing only against the app name without identifying the company behind it;
Submitting isolated screenshots that do not show the sender, date, or surrounding conversation;
Secretly recording calls without considering the Anti-Wiretapping Act;
Omitting proof that the lender received the written privacy complaint;
Treating a character reference as if that person automatically guaranteed the debt;
Assuming that clicking “allow” gives the app unlimited permission to use contacts or photos;
Claiming that every collection message is illegal when it is a factual, respectful payment reminder;
Ignoring legitimate court papers because other collection messages were abusive;
Paying a person who cannot verify the lender, account, balance, and official payment channel;
Sending regulators passwords, OTPs, PINs, or unredacted financial credentials.

When legal help is urgent

Consult a lawyer promptly if:

You receive a summons, subpoena, court order, prosecutor’s notice, or formal demand with a stated deadline;
The lender obtained a judgment, garnishment order, or other process you do not understand;
Someone is using your identity for loans or financial accounts;
Intimate images, fabricated arrest notices, or altered photographs are being circulated;
Threats identify your home, workplace, family members, or daily movements;
You suffered substantial financial, employment, medical, or reputational harm;
You intend to claim significant damages or pursue criminal charges;
The respondent is unregistered, cannot be identified, or appears to operate from outside the Philippines.

A regulator’s complaint process does not extend a court deadline. Respond to official legal papers separately even while the SEC, NPC, BSP, police, or NBI complaint is pending.

Frequently asked questions

Does harassment make the loan disappear?

No. A valid debt and unlawful collection conduct are separate issues. The lender may use lawful collection methods and pursue available civil remedies, while still being answerable for harassment or privacy violations.

Can the app contact my family or employer?

Not for debt collection merely because their numbers appeared in your phone. A person may be contacted for collection if that person separately agreed to be a guarantor or co-maker. A character reference may be contacted only for proper verification purposes, not to pressure that person into paying or to shame the borrower.

I was listed only as a reference. Can I complain?

Yes, if your own personal data was accessed, used, or disclosed improperly. Ask the lender how it obtained your number, request removal as a character reference where appropriate, preserve the messages, and complain to the NPC if the issue is not properly addressed.

Must I wait 15 days before going to the NPC?

Usually, you must first notify the organization in writing and document its failure to act or its failure to respond within 15 calendar days. The NPC may waive this at its discretion for good cause or a serious violation. Threats and immediate danger should be reported to law enforcement immediately.

Should I uninstall the lending app?

Preserve the app page, permissions, notices, messages, and loan records first. You may then revoke unnecessary permissions and uninstall it. Uninstalling does not retrieve or erase data already transferred to the lender.

Can I demand deletion of everything?

You may seek blocking, removal, or destruction of data that was unlawfully obtained, used for unauthorized purposes, or is no longer necessary. The lender may still retain information required by law or reasonably needed to establish, exercise, or defend legal claims. Ask it to identify the legal basis and retention period rather than assuming every record must be erased immediately.

What if I never applied for the loan?

Dispute it in writing immediately. Do not acknowledge the debt merely to stop the messages. Ask for the application, identity-verification records, disbursement destination, and account history; secure your accounts; and report suspected identity misuse to the lender, NPC, and the appropriate cybercrime authority.

Do I need a lawyer to file?

You may submit SEC and NPC complaints yourself. A lawyer is especially helpful when there are court papers, criminal allegations, major damages, identity theft, complicated evidence, or uncertainty about the correct respondent.

Official sources

This article provides general Philippine legal information, not legal advice for a specific case. Procedures and legal conclusions may depend on the lender’s regulatory status, the loan documents, the precise communications, and the available evidence. Official sources and complaint channels were checked on 2 August 2026.