Quick answer

You may report an online lending app for harassment, intimidation, public shaming, threats, deceptive collection tactics, or misuse of personal data even if you genuinely owe money. A valid debt gives the lender a right to use lawful collection methods—not a right to threaten you, shame you publicly, harvest your contacts, misuse your photographs, or disclose your debt to unrelated people.

Depending on what happened, file with:

The Securities and Exchange Commission (SEC) for unfair debt-collection practices by lending or financing companies;
The National Privacy Commission (NPC) for unauthorized, excessive, or harmful processing of personal data; and
The PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline when the conduct involves threats, fraud, identity misuse, account intrusion, or other potentially criminal acts.

These remedies may be pursued separately because each agency has a different jurisdiction. Filing a complaint does not automatically erase a legitimate loan, but the existence of a debt does not excuse unlawful collection.

What conduct may be reported?

Harassment and unfair debt collection

SEC rules prohibit lending and financing companies, their collection agencies, representatives, and outsourced collectors from using unfair collection practices. Reportable conduct may include:

Threatening violence, physical harm, property damage, arrest, imprisonment, or another action the collector cannot legally take;
Using insults, obscene language, profanity, intimidation, or degrading messages;
Publicly shaming the borrower;
Making false or deceptive statements about the debt, the collector’s authority, or the consequences of nonpayment;
Pretending to be a lawyer, police officer, court employee, government official, or another person;
Threatening to file a case that the collector has no legal basis or present intention to file;
Sending fabricated summonses, warrants, court orders, or government notices;
Disclosing or publishing the borrower’s name and alleged debt to unrelated persons;
Repeatedly contacting relatives, friends, employers, co-workers, or other people who are not guarantors;
Using the borrower’s contact list to pressure or embarrass the borrower; or
Communicating at unreasonable hours, subject to the circumstances and applicable exceptions.

A lender may send lawful payment reminders, demand payment, negotiate a settlement, engage an authorized collection agency, or bring a proper civil or criminal case when legally justified. Firm collection is not automatically harassment. The language used, frequency and timing of communications, identity of the recipients, truthfulness of the statements, and manner of processing personal data all matter.

Privacy violations

Under the Data Privacy Act of 2012, personal information must be processed transparently, for a legitimate purpose, and in a proportionate manner. Collection must be adequate, relevant, suitable, necessary, and not excessive.

The NPC Guidelines on Loan-Related Transactions, as amended, regulate lenders whether or not they possess the required SEC authority. Potential violations include:

Harvesting, copying, or saving an entire phone or email contact list for collection or harassment;
Obtaining social-media contacts and messaging them about the debt;
Contacting people who were not identified as guarantors;
Treating a character reference as a guarantor without that person’s separate consent;
Using a borrower’s photograph to shame, threaten, or embarrass the borrower;
Requiring unnecessary access to contacts, messages, storage, microphone, camera, location, or photographs;
Continuing to access an app permission after its stated purpose has ended;
Publishing a borrower’s personal information or alleged debt in group chats or on social media;
Sending altered photographs, “wanted” posters, funeral images, or defamatory announcements containing the borrower’s identity;
Sharing loan information with unrelated third parties without a lawful basis;
Processing information for unrelated marketing or cross-selling without a separate lawful basis;
Retaining personal data indefinitely without a defined legal or business need; or
Failing to explain what information is collected, why it is processed, who receives it, and how the borrower may exercise data-subject rights.

The government’s March 18, 2026 joint advisory on online lending platforms expressly states that contacting persons in the borrower’s contact list other than consenting guarantors for debt collection is prohibited. Character references are for identification or verification; they do not become guarantors merely because the borrower supplied their details.

What to do immediately

1. Preserve evidence before blocking or uninstalling the app

Save the evidence in its original form whenever possible:

Screenshots and screen recordings showing the complete conversation;
The collector’s phone number, profile, account name, email address, and social-media URL;
Dates and exact times of calls, texts, posts, and messages;
Audio or voicemail messages lawfully received by you;
Call logs and notification histories;
Copies of public posts, group-chat messages, and messages sent to your contacts;
Statements from relatives, employers, co-workers, or friends who were contacted;
The app’s name, developer, store listing, download link, package name, and version;
Screenshots of every permission requested or granted;
The privacy notice, terms and conditions, loan agreement, disclosure statement, repayment schedule, and collection notices;
Proof of amounts received and payments made;
Receipts, transaction references, bank or e-wallet records;
The collector’s claimed company name and authority;
Your written objection or privacy request and proof that it was received; and
Any fabricated legal document, arrest threat, edited photograph, or defamatory material.

Do not crop away the sender, date, time, URL, or surrounding context. Keep at least two backups. Avoid editing the original files; use copies when highlighting important portions.

Ask contacted persons to preserve their own messages and write a short signed account identifying when they were contacted, what was said, and how they know the borrower.

2. Secure your phone and accounts

After preserving evidence:

Revoke unnecessary app permissions through the phone’s settings;
Change passwords for email, social media, banking, and e-wallet accounts if compromise is suspected;
Enable multi-factor authentication;
Review active sessions and sign out unfamiliar devices;
Remove the app if it is no longer needed, but first preserve the loan records and evidence stored in it;
Report impersonating or abusive accounts through the platform’s reporting system; and
Warn your contacts not to click links, send money, disclose codes, or respond to threats.

Revoking access does not necessarily delete information the lender already copied. A written privacy request remains important.

3. Send a written demand to the lender

Address the notice to the company and its data protection officer, if identified in the privacy notice. State:

Your name and account or loan reference;
The collector’s name, number, or account;
The exact acts complained of;
The dates and persons contacted;
The personal data accessed, used, or disclosed;
That you object to harassment and unauthorized or excessive processing;
That all communications should be directed only to you or your authorized representative;
That the company must stop contacting persons who are not consenting guarantors;
That it must preserve records relevant to the complaint;
That you request identification of the company, collector, collection agency, recipients, source of the personal data, and lawful basis for processing; and
The corrective action requested, such as removal of an unlawful post, cessation of unauthorized disclosure, correction of inaccurate information, restriction of processing, or deletion when no lawful retention ground remains.

Send it by a method that produces proof of receipt. Keep the sent email, delivery confirmation, ticket number, or courier record.

A request for deletion is not absolute. The lender may retain information that is still reasonably necessary to service a lawful loan, comply with law, or establish, exercise, or defend legal claims. It may not retain or use the information indefinitely for an unspecified future purpose.

How to file an SEC complaint

The SEC regulates lending and financing companies and receives complaints involving unfair collection practices and violations of lending, financing, and disclosure laws.

The current joint government advisory directs complainants to:

Submit a complaint through SEC iMessage; or
Call the SEC hotline at 1-4732 (1-4SEC).

The SEC’s published complaint guidance for lending and financing companies instructs complainants to:

Complete the prescribed complaint form accurately;
File one complaint form for each respondent company;
Attach a valid government-issued ID; and
Attach all supporting evidence.

Useful attachments include the loan agreement, disclosure statement, amortization schedule, promissory note, payment receipts, transaction records, screenshots, call logs, posts, messages sent to third parties, and your prior written demand.

Identify both the app and the actual corporate lender. The app’s brand may differ from the company holding the SEC Certificate of Authority. Check the company through the SEC’s official records and Check with SEC. If you cannot identify the operator, provide every available identifier instead of guessing.

The SEC may require the respondent’s answer, evaluate the records, endorse issues to another agency, or commence administrative proceedings when warranted. The SEC complaint process does not itself authorize the SEC to cancel the debt, rewrite the contract, or judicially declare an interest provision void.

How to file an NPC complaint

Use the NPC process when the lender accessed, copied, disclosed, retained, or otherwise processed personal data unlawfully.

The prior written-notice requirement

As a general rule, the NPC 2021 Rules of Procedure require proof that:

You informed the lender, its data protection officer, processor, or concerned entity in writing about the privacy violation; and
It failed to take timely and appropriate action, or failed to respond within 15 calendar days from receipt.

The NPC may waive these requirements for good cause or in serious cases, including circumstances involving grave and irreparable harm that only prompt NPC action can prevent or mitigate. Explain and prove the urgency if you request a waiver.

Filing requirements

According to the NPC’s official complaint-filing page, submit either:

A completed and notarized complaint-assisted form; or
A verified complaint.

Attach copies of the evidence and any witness affidavits. Filing may be made personally, by registered mail, by courier, or by electronic mail when authorized by the NPC. Follow the NPC’s current formatting, signature, service, and submission instructions rather than sending an informal narrative alone.

A representative generally needs a special power of attorney. If a juridical entity represents data subjects, additional corporate authority documents are required.

Clearly identify:

The personal data involved;
How it was obtained;
The purpose originally stated by the app;
How it was later used or disclosed;
The people or platforms to whom it was disclosed;
Why the processing was unauthorized, excessive, deceptive, or disproportionate;
The harm caused or continuing risk; and
The relief requested.

The NPC may order compliance, impose a temporary or permanent ban on processing, award indemnity where legally supported, impose administrative fines, or recommend prosecution. These outcomes are not automatic and depend on the evidence and applicable law.

When to report to cybercrime authorities

Report promptly when messages or online acts may involve:

Threats of physical injury, death, kidnapping, sexual violence, or property damage;
Extortion or demands unrelated to a legitimate debt;
Impersonation of police officers, lawyers, courts, or government agencies;
Fabricated warrants, summonses, or criminal charges;
Account hacking or unauthorized access;
Identity theft or use of another person’s identity;
Fraudulent payment links or instructions;
Publication of defamatory or manipulated content;
Doxxing or disclosure that creates an immediate safety risk; or
Continuing harassment despite demands to stop.

The Cybercrime Prevention Act designates the PNP and NBI as law-enforcement authorities for cybercrime. The March 2026 joint advisory lists these reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

You may also go to the nearest police station, PNP Anti-Cybercrime Group office, or NBI office. Bring your identification, device, printed screenshots, original electronic files, loan records, payment records, and a chronological statement.

Do not assume that every rude message automatically constitutes a particular crime. Whether conduct amounts to grave threats, unjust vexation, libel, identity theft, illegal access, coercion, or another offense depends on its precise words, context, intent, method, and evidence.

Does nonpayment allow the lender to have you arrested?

No person may be imprisoned merely for debt under the Constitution. A lender may pursue lawful civil remedies, and particular conduct connected with a transaction may create separate criminal exposure if all elements of an offense are independently established. However, ordinary inability or failure to pay a loan does not by itself authorize arrest.

A collector cannot lawfully arrest you, issue a warrant, or send police to collect a private debt. Arrest warrants are issued by courts under applicable law, not by lenders or collection agents.

Do not ignore authentic documents from a court, prosecutor, police unit, or government agency. Verify them directly using official contact details rather than numbers supplied by the collector.

If you are only a contact or character reference

You may complain even if you are not the borrower when your own personal information was unlawfully obtained or used.

Tell the collector in writing that:

You are not the borrower or a consenting guarantor;
You do not authorize further use of your information;
You require disclosure of how your data was obtained;
You demand that collection communications to you stop; and
You request deletion or restriction of your data when no lawful retention ground exists.

Preserve the messages and proof that you sent the objection. A person does not become liable for another’s loan merely by appearing in the borrower’s phone contacts or being named as a character reference. Guarantor liability requires a legally sufficient undertaking; it cannot be created by the lender unilaterally.

Dealing with the debt while the complaint is pending

Keep the debt dispute separate from the harassment complaint.

Request a complete statement of account and itemized computation;
Verify the lender’s corporate identity and authority;
Compare the amount released with the principal, interest, fees, penalties, and payments credited;
Pay only through a verified official channel;
Obtain a receipt for every payment;
Put settlement proposals in writing;
Do not send money to a collector’s personal account without verified authority; and
Do not admit an amount you have not checked.

If you dispute the amount, state the specific reason. Avoid promising a payment date you cannot meet. A complaint against collection practices does not, by itself, suspend accruals, prevent a lawful case, or discharge the underlying obligation.

Common mistakes that weaken a complaint

Deleting the app, messages, or call logs before preserving evidence;
Submitting cropped screenshots without the sender, date, time, or context;
Naming only the app and not identifying the corporate lender;
Filing one SEC form against several companies despite the one-form-per-respondent instruction;
Filing an NPC complaint without first giving the respondent written notice or explaining why the requirement should be waived;
Sending only conclusions such as “they harassed me” without quoting or attaching the actual communications;
Exaggerating the facts or including allegations unsupported by records;
Posting IDs, loan documents, phone numbers, or private messages publicly;
Paying an unverified personal account to make threats stop;
Assuming that blocking a number prevents the lender from using information already copied; or
Ignoring a genuine summons, subpoena, prosecutor’s notice, or court order because earlier threats were fake.

When legal help is urgent

Seek immediate legal or law-enforcement assistance when:

There is a credible threat to life, physical safety, a child, or property;
Intimate images or sexual threats are involved;
The collector has published your address, workplace, identification documents, or family information;
Your accounts have been accessed or taken over;
Money is being demanded through extortion or impersonation;
The lender continues mass disclosure after receiving a written objection;
You need an urgent NPC temporary ban on processing;
You received authentic court, prosecutor, police, or administrative documents;
Several lenders or collectors are coordinating attacks; or
The incident caused employment loss, serious reputational harm, medical harm, or substantial financial loss requiring proof and damage assessment.

Call 911 when there is an immediate danger. Do not personally confront a threatening collector.

Frequently asked questions

Can I complain even if my loan is overdue?

Yes. Delinquency does not remove your privacy rights or legal protection against unfair collection. The lender may collect only through lawful means.

Is messaging my relatives automatically illegal?

The purpose, recipient, information disclosed, and recipient’s legal role matter. Debt-collection contact with people merely harvested from your phone is prohibited. Under the current government advisory, collection contact should be limited to the borrower and a person who separately consented to act as guarantor—not an ordinary contact or character reference.

Does clicking “Allow contacts” authorize public shaming?

No. Consent must be freely given, specific, informed, and tied to a legitimate purpose. Permission to access information is not blanket authority to harass, shame, publish, or use the information disproportionately. Deceptive designs and forced, unnecessary permissions may also undermine purported consent.

Can I demand that all my information be deleted?

You may exercise applicable data-subject rights, but erasure is not absolute. Information may be retained when necessary for a lawful outstanding transaction, regulatory compliance, or legal claims. Data that is unnecessary, unlawfully collected, or retained without a valid purpose may be subject to deletion, blocking, or other corrective action.

Should I report to both the SEC and NPC?

Often, yes. Report the unfair collection conduct to the SEC and the personal-data misuse to the NPC. Add a cybercrime report if the facts indicate threats, fraud, illegal access, identity misuse, or another possible offense.

Will filing a complaint cancel my loan?

No. Agency complaints address regulatory, privacy, or potentially criminal misconduct. The validity and amount of the debt remain separate questions.

Can the app contact my employer?

Ordinary disclosure of a debt to an employer or co-worker merely to pressure or shame the borrower may violate collection and privacy rules. Different considerations may apply if the employer is a genuine guarantor, payroll-linked contractual participant, or recipient authorized by law or a valid agreement. The exact documents and disclosure should be reviewed.

What if the lender is unregistered or uses changing app names?

Report it anyway. Preserve all app-store links, package names, websites, payment accounts, numbers, emails, company claims, and transaction records. State that the operator’s identity or authority could not be verified. The privacy rules for loan-related processing can apply even to a person acting as a lender without the required SEC authority.

This article provides general Philippine legal information, not legal advice for a particular case. Agency procedures and contact details can change, while liability depends on the complete facts, communications, contracts, and evidence. Official sources and procedures were checked as of August 24, 2026.