Quick answer

If an online lending app is threatening you, publicly shaming you, contacting your relatives, friends, coworkers, or other people in your phone without a lawful basis, or using your personal data excessively for debt collection, you can report the conduct even if you genuinely owe money.

For most online lending platforms operated by lending or financing companies, the main government agencies are the Securities and Exchange Commission (SEC) for unfair or abusive lending and collection practices and the National Privacy Commission (NPC) for misuse of personal data. If the lender is a bank, digital bank, or another institution supervised by the Bangko Sentral ng Pilipinas (BSP), the BSP's consumer-assistance process may apply instead. Threats, extortion, account compromise, stalking, impersonation, or other possible crimes may also be reported separately to law-enforcement authorities.

Current government rules expressly prohibit unnecessary or excessive processing of borrowers' personal data, including disproportionate access to contact lists. The 2026 joint advisory of the DICT, NPC, and SEC also reiterates that lenders and online lending platforms must not use personal data for harassment or unfair debt collection and must not contact people in a borrower's contact list for collection merely because their numbers are stored on the phone. For debt-collection purposes, the advisory identifies the borrower's guarantor as the person who may be contacted in that capacity. (National Privacy Commission)

A good practical sequence is: preserve the evidence first, identify the legal lender, send a written complaint to the lender or its official consumer-assistance/privacy channel, report lending violations to the SEC, and file a privacy complaint with the NPC when applicable. For an NPC complaint, there is an important procedural point: as a general rule, you must first notify the respondent in writing and give it an opportunity to address the privacy violation. If it fails to take timely and appropriate action, or does not respond within 15 calendar days from receipt, you may proceed with the NPC complaint and attach proof of that prior notice. (National Privacy Commission)

What kinds of online lending conduct can be reported?

Not every collection message is unlawful. A lender may make reasonable efforts to collect a legitimate debt. The problem arises when collection methods cross legal, privacy, or consumer-protection boundaries.

Conduct that may justify a complaint includes:

threatening physical harm, criminal acts, or other unlawful consequences;
threatening to take action that the collector has no legal right or actual ability to take;
publicly shaming or humiliating a borrower to pressure payment;
disclosing a borrower's debt or personal information to unrelated third persons as a collection tactic;
accessing or harvesting phone contacts when that access is unnecessary or disproportionate;
messaging or calling people found in the borrower's contact list merely to pressure the borrower;
using a character reference as though that person automatically became responsible for the debt;
continuing to process personal information for purposes inconsistent with the purpose for which it was collected;
requiring unnecessary app permissions or using granted permissions beyond what is necessary and proportionate; and
other harassment, intimidation, abusive collection, or privacy-invasive practices.

The NPC's rules specifically distinguish a character reference from a guarantor. Giving someone's name as a character reference does not, by itself, make that person liable for the loan. A guarantor is someone who actually undertakes the legal obligation to answer for the borrower's debt under the applicable agreement, and the NPC rules require separate consent in relation to the guarantor's personal data. (National Privacy Commission)

The fact that a borrower clicked "Allow" when an app requested access to contacts does not give the lender unlimited authority to use every contact for collection. Consent and app permissions remain subject to the Data Privacy Act's requirements and to the principles of legitimate purpose, proportionality, and lawful processing. (National Privacy Commission)

The debt and the harassment are separate legal issues

A borrower should not assume that harassment automatically cancels a valid loan.

The lender may have a legitimate right to collect an enforceable obligation while still violating privacy, consumer-protection, or collection rules in the way it tries to collect. Conversely, a borrower may also have a genuine dispute over the principal, interest, charges, payments already made, identity of the creditor, or validity of particular loan terms.

Keep these issues separate. If you dispute the amount, put that dispute in writing and request an accounting. If an undisputed obligation remains due, use verified and lawful payment channels. Do not send money merely because a threatening caller provides a personal bank or e-wallet account and demands immediate payment.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, recognizes financial consumers' rights to fair and equitable treatment, protection of personal data, transparency, and timely handling of complaints. It also prohibits abusive debt-collection or recovery practices by covered financial service providers. (eLibrary)

Step 1: Preserve the evidence before deleting anything

Do this before uninstalling the app, clearing messages, blocking every number, or resetting your phone.

Save screenshots or screen recordings showing the app name, account or loan details, threats, collection messages, caller numbers, social-media messages, posts, comments, emails, and any communications sent to other people.

Also preserve the loan agreement, disclosure statement, privacy notice, payment history, receipts, transaction IDs, collection notices, and any document showing the legal name of the lending or financing company.

If the app still shows its requested permissions, take screenshots of those permissions before changing them. Save the app-store listing if available, including the developer or publisher information.

Ask relatives, friends, coworkers, employers, or other people who were contacted to preserve their own screenshots. Their evidence is often stronger than a borrower's recollection that "my contacts were called." If they are willing, ask them to record the date, time, phone number or account used, and the exact nature of the communication while events are still fresh.

Keep copies somewhere other than the affected phone—for example, in secure cloud storage or another device. Preserve originals where possible rather than repeatedly editing, cropping, or annotating them.

Step 2: Identify the actual lender, not just the app name

The brand name displayed by an app may not be the legal name of the company extending the loan.

Check the loan agreement, disclosure statement, privacy policy, collection notice, receipts, and payment instructions for the corporate name. Then check the SEC's current lists and advisories concerning lending companies, financing companies, and recorded online lending platforms. The SEC continues to publish notices concerning authorized and unauthorized online lending activity. (Securities and Exchange Commission)

This matters because a complaint that says only "LoanFast App harassed me" may be much harder to investigate than one identifying:

the app or brand;
the legal lending or financing company;
any collection agency involved;
the phone numbers, email addresses, or social-media accounts used; and
the loan account or transaction involved.

If you cannot determine the legal entity, report that fact and attach whatever evidence you have. Do not abandon the complaint simply because the app appears unregistered or has disappeared from an app store.

Step 3: Secure your phone and accounts

After preserving evidence, review the app's permissions and revoke access that is no longer necessary, especially access to contacts, photos, storage, location, or other sensitive device functions.

NPC rules require online lending applications to avoid unnecessary processing and unnecessary permissions. They also contemplate informing users that access can be revoked when the relevant purpose has already been achieved and there is no other lawful basis for continued access. (National Privacy Commission)

If you reused passwords, suspect account compromise, or disclosed credentials to someone posing as a collector, change the affected passwords and enable stronger account security. Never disclose an OTP, PIN, password, recovery code, or similar authentication credential merely because a collector demands it.

Step 4: Send the lender a written complaint

A phone call to customer service may not be enough, particularly if you may later file with the NPC.

Send a written complaint through an official email address, consumer-assistance mechanism, privacy or data-protection channel, or other channel that gives you reliable proof of transmission and receipt.

State the facts plainly: the dates, numbers or accounts involved, what information was disclosed, who was contacted, what threats or statements were made, and what remedy you are asking for.

For a privacy complaint, you may ask the company to stop contacting non-guarantors, stop unauthorized disclosures, explain the source and purpose of the processing, identify relevant recipients of your data where your statutory access rights apply, correct inaccurate information, and block or remove unlawfully processed information where the requirements of the Data Privacy Act are met.

The Data Privacy Act gives data subjects rights that include being informed, obtaining reasonable access to specified information concerning processing, correcting inaccuracies, and seeking blocking, removal, or destruction in circumstances recognized by law. These rights are not an unconditional right to erase every record: a lender may still have lawful grounds to retain certain information, including records required by law or reasonably necessary for legitimate legal claims. (Lawphil)

A simple written notice can say:

I am formally notifying your company of alleged privacy and collection violations involving my loan account. On [dates], your company, app, or collector [briefly describe what happened]. Please stop unauthorized disclosure and collection communications to persons who are not legally responsible for my debt, preserve all records relating to these incidents, investigate the matter, and confirm in writing the action taken. I also request appropriate access, correction, blocking, or removal of personal data to the extent provided by the Data Privacy Act. Please acknowledge receipt of this notice.

Keep the sent email, ticket number, delivery confirmation, screenshots, and any reply.

For purposes of the NPC's exhaustion requirement, the important point is that the respondent was informed in writing of the privacy violation or personal-data breach and given an opportunity to address it. The NPC's current rules state that a complaint may proceed when the respondent fails to take timely and appropriate action or does not respond within 15 calendar days from receipt. (National Privacy Commission)

That 15-day requirement relates to the NPC complaint process. It does not mean that someone facing a credible threat of violence or another apparent crime must wait 15 days before seeking police or other emergency assistance.

Step 5: Report unfair lending or collection practices to the SEC

If the respondent is a lending company, financing company, or online lending platform under SEC supervision, the SEC is the principal regulator for licensing and lending-related market conduct.

The SEC's current iMessage system includes a complaint category for Complaints on Financing and Lending Companies and allows complainants to create and track service tickets. (Securities and Exchange Commission)

Prepare a concise chronology and attach the strongest supporting records. Include the legal company name if known, app name, loan details, screenshots, recordings or messages, payment records, the identity of the collection agency if known, and copies of any complaint already sent to the company.

If your research indicates that the app is not among recorded platforms or that the company may be operating without proper authority, say so in the complaint and explain exactly what you checked. Let the SEC determine the regulatory status rather than making an unsupported accusation yourself.

Republic Act No. 11765 requires covered financial service providers to maintain a consumer-assistance mechanism for complaints, inquiries, and requests and gives financial regulators authority to establish mechanisms for consumer redress. (eLibrary)

Step 6: File a privacy complaint with the National Privacy Commission

The NPC is the relevant agency when the core issue involves collection, access, use, disclosure, storage, or other processing of personal information in violation of the Data Privacy Act.

The NPC's current complaint procedure generally requires either its complaint-assisted form or a verified complaint, together with supporting evidence. The NPC states that complaints may be submitted through authorized filing channels, including personal filing, courier or registered mail, and electronic submission under its rules. Its public complaint page currently identifies complaints@privacy.gov.ph for scanned complaints submitted by email. (National Privacy Commission)

Use the current NPC complaint form rather than an old copy saved from years ago. The NPC announced a revised Complaint-Affidavit template effective July 1, 2025 and directed complainants to use the updated version. (National Privacy Commission)

Attach organized evidence, including:

the written notice you first sent to the lender, collector, app operator, or other respondent;
proof that the respondent received it;
the respondent's reply, if any;
screenshots, messages, call records, posts, app-permission records, loan documents, or other relevant evidence; and
affidavits or evidence from other affected persons when available.

A complaint can encounter procedural problems if the respondent was never given the required opportunity to address the privacy issue, if the allegations are not sufficiently supported, if the parties cannot reasonably be identified or traced, or if the dispute does not actually involve matters within the NPC's jurisdiction. (National Privacy Commission)

Where a violation is established, the consequences depend on the facts and the applicable provisions. NPC proceedings can lead to appropriate administrative remedies, fines or other sanctions, and the Commission may refer records for criminal prosecution when the circumstances warrant it. Civil damages and criminal liability are separate questions that depend on the evidence and legal basis. (National Privacy Commission)

If you are a contact or character reference instead of the borrower

You may have your own privacy issue.

NPC rules make clear that a character reference is not automatically a guarantor. The purpose of collecting a character reference's information is limited, and the individual must be appropriately informed. The rules also provide for the character reference to have an opportunity to have their personal information removed in that capacity. (National Privacy Commission)

If a lending app obtained your number from somebody else's phone and began repeatedly calling you, disclosed the person's debt to you, threatened you, or used your information for purposes unrelated to any role you actually accepted, preserve your own evidence. You do not necessarily have to rely on the borrower to complain for you.

A person who actually signed as a guarantor—or who is independently liable under the loan documents—is in a different legal position. Liability should be determined from the contract and surrounding facts, not simply from the fact that the collector calls that person a "guarantor."

If the lender is supervised by the BSP instead

Not every app-based loan falls under SEC supervision.

If the credit provider is a bank, digital bank, or another BSP-supervised financial institution, the BSP's consumer-redress framework may apply. BSP guidance generally requires the consumer to raise the concern first through the institution's own Financial Consumer Protection Assistance Mechanism. An unresolved complaint may then be elevated through the BSP's Consumer Assistance Mechanism. (Bureau of the Treasury)

When in doubt, identify the legal entity on the loan contract first. The regulator follows the institution, not merely the fact that the loan was obtained through a mobile app.

When harassment may also require a police or cybercrime report

Regulatory complaints to the SEC or NPC are not substitutes for immediate law-enforcement assistance when the facts indicate possible criminal conduct.

Consider promptly contacting law enforcement if the collector makes a credible threat of physical violence, attempts extortion, unlawfully takes over an account, impersonates you, stalks you, threatens to publish intimate material, or engages in another act that appears independently criminal.

The Philippine National Police Anti-Cybercrime Group maintains channels for cybercrime complaints, including its Cyber Response Unit, while the National Bureau of Investigation's Cybercrime Division receives requests for investigative assistance. (PNP ACG)

Preserve the original messages, phone numbers, account identifiers, payment instructions, URLs, transaction records, and devices relevant to the incident. Do not edit or manufacture evidence to make a threat appear stronger than it was.

If there is an immediate risk to a person's physical safety, prioritize immediate police or emergency assistance rather than waiting for the completion of an SEC or NPC administrative process.

Evidence that makes a complaint easier to investigate

The strongest complaint is usually not the longest one. It is the one that allows an investigator to understand what happened quickly.

A useful evidence file should show the chronological sequence: when the loan was obtained, what permissions the app requested, when payment became disputed or overdue, when collection began, what the collector said or did, which third parties were contacted, when you complained to the company, and how the company responded.

For screenshots, keep enough surrounding information to identify the sender, platform, date, and context. If a Facebook post or other online material is involved, preserve the URL and account identity when possible, not merely a cropped portion of the text.

Keep receipts and proof of payments. Some collection disputes arise because a collector continues demanding an amount already paid or uses a balance that the borrower contests.

If a third party received the embarrassing message, ask that person to preserve the message on their own device. A contemporaneous screenshot from the actual recipient can materially strengthen the factual record.

Common mistakes to avoid

Deleting everything before documenting it. Blocking a collector may be sensible, but preserve evidence first.

Assuming the app name is the legal lender's name. Check the agreement and SEC records.

Filing an NPC complaint without first making the required written notice. Unless a procedural exception under the applicable rules applies, failure to show that the respondent had an opportunity to address the violation can derail the complaint. The NPC expressly looks for proof of this step. (National Privacy Commission)

Using an outdated NPC form. Download the current form directly from the NPC.

Demanding deletion of every loan record. Privacy rights are substantial, but deletion is not absolute when information still has a lawful basis for retention. Frame the request around the specific unlawful or unnecessary processing.

Assuming that a privacy violation automatically eliminates the debt. The collection misconduct and the underlying obligation are legally distinct questions.

Paying a threatening stranger's personal account without verification. Verify payment instructions with the legitimate lender.

Replying with threats or defamatory accusations. Keep your responses factual. Your complaint is stronger when your own communications remain professional and accurately documented.

Posting your IDs, loan agreement, phone number, or screenshots containing other people's personal data publicly. You may unintentionally create a second privacy problem while trying to expose the first one. Redact unnecessary personal information when sharing material outside official complaint channels.

When legal help becomes especially important

Consider obtaining individualized legal advice promptly if there are substantial disputed loan amounts, repeated disclosures to employers or customers, severe reputational harm, identity theft, an account takeover, threats against you or your family, publication of sensitive images or documents, court papers, a demand from an unfamiliar collection company, or uncertainty over whether you actually signed as borrower, co-obligor, or guarantor.

Legal advice can also be useful when you intend to pursue damages rather than merely asking the regulator to stop the conduct, because the proper cause of action, parties, evidence, jurisdiction, and available relief will depend on the specific facts.

FAQ

Can an online lending app call everyone in my contacts because I missed a payment?

Generally, no. Current NPC and joint government guidance prohibits using a borrower's contact list indiscriminately for debt collection. A person does not become responsible for the debt merely because their number appears in your phone. The rules specifically distinguish ordinary contacts and character references from an actual guarantor. (National Privacy Commission)

What if I originally allowed the app to access my contacts?

That permission does not authorize unlimited or disproportionate processing. Personal-data processing must still have a lawful basis and comply with necessity, proportionality, and applicable privacy rules. Using access to facilitate harassment or improper collection can still be prohibited. (National Privacy Commission)

Should I complain to the SEC or the NPC?

Often, both issues may exist. Report abusive lending or collection conduct involving an SEC-regulated lending or financing company to the SEC. Report unlawful processing or disclosure of personal information to the NPC. The agencies address different legal responsibilities.

Do I have to complain to the lending company before going to the NPC?

As a general rule, yes. The NPC's complaint rules require written notice to the respondent and an opportunity to address the privacy violation. If the respondent takes no timely and appropriate action or gives no response within 15 calendar days from receipt, you may proceed and attach proof of that prior notice. (National Privacy Commission)

This does not prevent immediate reporting to police when there is a credible safety threat or apparent crime.

Can I complain if the lending app appears unregistered?

Yes. Preserve the evidence and report the app and the company behind it, if identifiable, to the SEC. The SEC maintains current lending and financing company information and issues advisories concerning unauthorized online lending activity. (Securities and Exchange Commission)

Does naming someone as a character reference make that person a guarantor?

No. NPC rules expressly distinguish the two. A guarantor must actually undertake the relevant obligation; simply listing someone's name or number as a character reference does not automatically impose liability for the debt. (National Privacy Commission)

Can a friend, coworker, or relative who was contacted file a privacy complaint?

Potentially, yes. If that person's own personal information was improperly obtained, used, or disclosed, they may have rights as a data subject independent of the borrower's complaint. The precise remedy will depend on what information was processed and why.

Can I stop paying the loan because the collector harassed me?

Do not assume so. Collection misconduct can be actionable without automatically extinguishing an otherwise valid debt. If you dispute the debt, interest, fees, payments credited, or identity of the lender, document the dispute and seek advice based on the actual loan documents.

Do I need a lawyer to report the app?

A person can generally use the agencies' own complaint mechanisms without retaining counsel. A lawyer becomes more important when the facts involve substantial damages, serious threats, identity theft, complicated contractual liability, court proceedings, possible criminal offenses, or a significant dispute over the debt itself.

Official sources and complaint channels

General-information disclaimer

This article provides general Philippine legal information, not legal advice for a particular loan or incident. The correct remedy can depend on the lender's legal identity and regulator, the loan agreement, app permissions, exact collection communications, persons contacted, evidence available, and whether separate criminal or civil issues are involved. Laws, regulations, forms, filing systems, and agency procedures can change.

Current law and official procedures source-checked as of August 25, 2026.