Quick answer

If an online lending app threatens, shames, repeatedly abuses, or contacts people in your phonebook to pressure you into paying, preserve the evidence and complain through the proper channels:

Send a written complaint and privacy request to the lender or app operator.
Report unfair collection by a lending or financing company to the Securities and Exchange Commission (SEC).
Report misuse or disclosure of personal data to the National Privacy Commission (NPC). Ordinarily, you must first give the company 15 calendar days from receipt of your written complaint to respond appropriately.
If there are threats of violence, extortion, identity theft, account hacking, impersonation, or other possible crimes, promptly approach the police or National Bureau of Investigation (NBI).

Harassment does not erase a valid debt. A lender may lawfully demand payment and pursue available remedies, but it may not use threats, humiliation, unauthorized disclosure, or disproportionate access to your contacts as collection tools.

What conduct may be unlawful?

Unfair or abusive debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by lending and financing companies, including conduct involving:

Threats of violence or other criminal means against a person, reputation, or property
Threats to take action that cannot legally be taken
Obscene language, insults, or profane language intended to abuse
Disclosure or publication of borrowers’ names and other personal information, subject to lawful exceptions
False representations or deceptive means used to collect a debt
Contact at unreasonable or inconvenient times
Communicating with people in the borrower’s contact list other than persons properly identified as guarantors or co-makers, subject to the governing rules

Whether a particular message violates the rules depends on its actual wording, context, frequency, recipients, and the collector’s authority. A firm but truthful payment reminder is not automatically harassment.

Misuse of contacts, photos, and other personal data

Under the Data Privacy Act of 2012 and the NPC’s rules for loan-related transactions, processing must have a lawful basis and comply with transparency, legitimate purpose, and proportionality.

The current rules are particularly important for online lending apps:

Unconstrained, excessive, or disproportionate processing of a borrower’s contact list is prohibited.
A lender may not use contact-list information in a way that leads to harassment or unfair collection.
For debt collection, the lender may contact only a person identified as a guarantor. It may not contact everyone in the borrower’s phonebook.
A character reference is not automatically a guarantor.
Character references may be contacted to verify the borrower’s identity or the information supplied, but not for unrelated marketing, cross-selling, or indiscriminate debt collection.
Access to contacts must be limited to what is necessary to let the borrower select references or guarantors.
Camera or photo-gallery access allowed for identity verification, fraud prevention, or payment verification must be limited to the relevant stage and purpose.
A borrower’s photograph may not be altered, posted, or circulated to harass or embarrass the borrower into paying.

Tapping “Allow” when installing an app does not necessarily authorize every later use of the data. Consent and app permissions do not excuse processing that is excessive, misleading, unrelated to the disclosed purpose, or otherwise prohibited by law.

These protections also matter to people who never borrowed. If an app obtained your number from someone else’s phone and is contacting you even though you are not a guarantor, you may object to the processing and complain about the misuse of your information.

What to do immediately

1. Protect yourself if there is an urgent threat

If a collector threatens physical harm, says someone is on the way to your home or workplace, demands money through extortion, or publishes information that creates an immediate safety risk:

Call 911 or contact the nearest police station.
Tell household members, building security, or your employer’s security office if the threat appears credible.
Do not meet the collector alone.
Do not send additional identity documents, passwords, one-time PINs, or money to an unverified account.
Preserve the threatening messages before blocking the sender.

Report possible cybercrime to the NBI Online Complaint portal or seek assistance from the NBI Cybercrime Division. A police or NBI complaint is separate from an SEC or NPC administrative complaint; more than one remedy may apply to the same incident.

2. Preserve the evidence before deleting the app

Save evidence in its original form whenever possible:

Screenshots showing the full message, sender, date, and time
The complete message thread, not only the most offensive line
Call logs and available voicemail or audio messages
URLs and screenshots of social-media posts
Copies of messages sent to relatives, friends, co-workers, employers, or clients
Written statements from recipients describing what they received
The app’s name, icon, download page, developer name, package name, and version
The lender’s corporate name, SEC registration number, Certificate of Authority number, website, email addresses, and phone numbers
The privacy notice, loan agreement, disclosure statement, repayment schedule, receipts, and account ledger
Screenshots of the permissions requested by the app
Proof of any permission you revoked
Payment instructions and the destination account or e-wallet
Your written complaint to the company and proof that it was received
The company’s response, ticket number, and subsequent collection messages

Create a chronological incident log. For every event, record the date, time, channel, sender, exact conduct, recipient, and supporting file name. Back up the evidence somewhere the app cannot access.

Avoid editing or cropping away identifying details. If you must redact information when sharing a copy publicly, keep an unredacted original for investigators.

3. Limit further access to your device

After preserving evidence:

Review the app’s permissions and revoke unnecessary access to contacts, call logs, SMS, camera, microphone, storage, location, and social-media accounts.
Change passwords if you reused a password or suspect unauthorized access.
Enable multi-factor authentication on email, social-media, banking, and e-wallet accounts.
Review active sessions and sign out unfamiliar devices.
Warn contacts not to click links or send money in response to collection messages.
Uninstall the app if it is no longer needed, but only after saving the agreement, payment records, privacy notice, and evidence.

Revoking app access does not cancel the loan or prevent lawful collection through proper channels.

First send a written complaint to the company

Identify the legal company behind the app. The brand name displayed on a phone may differ from the corporation that issued the loan.

The written complaint should include:

Your name and loan or account reference, with only the minimum identity information necessary
The app and company names
A dated, factual account of what happened
The personal data accessed, used, or disclosed
The numbers or accounts that contacted you or other people
Copies of representative evidence
A clear request for action
A reasonable channel for the company’s written response

You may demand that the company:

Stop threats, insults, public shaming, and contact with unrelated third parties
Identify the company and collection agency handling the account
Explain where it obtained the affected personal data
State the lawful basis and purpose for processing that data
Provide access to personal data it holds about you, where the right applies
Correct inaccurate information
Block, erase, or stop unlawful processing, subject to lawful retention and other exceptions
Preserve relevant records for an investigation
Provide an accurate statement of account and a lawful payment channel

Send the complaint to the company’s consumer-assistance unit and data protection officer, if identified. Use email, registered mail, courier, an in-app ticket, or another method that produces proof of receipt.

For an NPC complaint, proof that the respondent received this written notice is important. Under the NPC complaint rules, the respondent ordinarily has 15 calendar days from receipt to take timely and appropriate action. The NPC may waive exhaustion requirements in qualifying circumstances, but a complainant should not assume that an exception applies.

How to complain to the SEC

Use the SEC route when the respondent is a lending or financing company and the issue concerns unfair collection, operating authority, loan disclosures, or related regulatory violations.

The SEC instructs complainants to:

Complete its complaint form accurately.
File one complaint form for each respondent company.
Attach a valid government-issued ID.
Attach supporting evidence, such as the loan disclosure statement, agreement, repayment schedule, receipts, promissory note, communications, and screenshots.

The SEC’s official complaint page provides the current form and filing instructions: SEC complaints for lending and financing companies.

The page currently allows filing by email at flcd_complaints@sec.gov.ph and specifies this subject format:

COMPLETE NAME_RESPONDENT COMPANY_SUBJECT OF COMPLAINT

The SEC may send the complaint to the company for an answer or comment. Its published procedure gives the company 10 days from receipt to respond. If sufficient grounds exist, the SEC may commence an administrative case.

The SEC cannot, through this complaint process alone, rewrite the loan contract, declare the contract void, cancel or settle the debt, or rule that an interest rate is void merely for being excessive. Those questions may require a different proceeding and a fact-specific legal assessment.

You can also use the SEC iMessage portal and consult the SEC’s official records to determine whether the company is registered and has authority to operate. Corporate registration by itself is not the same as authority to conduct a lending business.

How to complain to the National Privacy Commission

Use the NPC route when the app or collector improperly accessed, used, retained, altered, or disclosed personal information—for example, by messaging unrelated contacts, posting a borrower’s photo, or using phonebook data for harassment.

Complete the current form

The NPC introduced a new Complaint-Affidavit effective July 1, 2025. Use the current form linked on the NPC complaint page or the current Complaint-Affidavit, not an old copy saved elsewhere.

The form calls for:

Complainant and respondent information
The personal data processed
The privacy violations alleged
A clear chronological narration
The date, time, and place of the incident
All supporting evidence
The relief requested
Verification and certification against forum shopping
A valid government-issued ID

The Complaint-Affidavit must be completed, signed, and notarized. If witnesses received collection messages, attach their affidavits when practicable.

Satisfy the 15-day exhaustion requirement

Before filing, ordinarily:

Inform the company in writing of the privacy violation or personal-data breach.
Give it an opportunity to take appropriate action.
Wait until it fails to act appropriately or 15 calendar days pass from its receipt without a response.
Attach the complaint, proof of receipt, and any response to your NPC filing.

Do not confuse this 15-day period with an automatic deadline for the NPC to decide the case.

Submit the complaint

The NPC’s published procedures permit filing personally, by registered mail, by courier, or by authorized email submission. Its current complaints address is complaints@privacy.gov.ph. Check the NPC complaint mechanics immediately before filing because forms, technical requirements, fees, addresses, and accepted channels can change.

Electronic documents should be properly signed and submitted in PDF format when practicable. Keep the sent email, delivery receipt, attachments, and any acknowledgment or docket number.

A complaint may be dismissed outright if it is defective in form, lacks evidence, fails to show exhaustion of remedies, does not involve a privacy issue, or does not sufficiently identify or substantiate the alleged violation.

What if the lender is supervised by the BSP?

Some digital loans are issued by banks or other Bangko Sentral ng Pilipinas-supervised financial institutions rather than SEC-regulated lending companies.

First complain through the institution’s own consumer-assistance mechanism. If its response is unsatisfactory or the concern remains unresolved, elevate it through the BSP Consumer Assistance Mechanism. The BSP accepts escalated concerns through its BSP Online Buddy and through a completed complaint, inquiry, or request form sent to consumeraffairs@bsp.gov.ph.

Check the loan agreement and disclosure statement to identify the actual creditor and regulator. The app’s technology provider, payment processor, collection agency, and lender may be different entities.

If the app appears unlicensed or fraudulent

A lending company may not conduct lending business without SEC authority. Report an app that hides its corporate identity, uses another company’s documents, lacks apparent authority, or directs payment to suspicious personal accounts.

Preserve:

The app-store listing and download URL
Advertised company and brand names
SEC or authority numbers claimed by the app
Loan and payment records
Names and account details of payment recipients
Advertisements and social-media pages
Messages showing misrepresentation or impersonation

Verify the company through official SEC facilities and include any discrepancy in your SEC report. Do not rely solely on a registration certificate shown inside the app; verify it independently.

What happens to the loan while a complaint is pending?

A complaint does not automatically suspend payment, interest, fees, or collection. Unless a regulator, court, contract, or applicable law provides otherwise, continue to address the undisputed obligation.

Ask the lender in writing for:

A complete and itemized statement of account
The principal, interest, fees, penalties, payments, and current balance
A copy of the disclosure statement and loan agreement
The official payment channel
Available restructuring or payment arrangements

If you dispute a charge, identify the exact amount and reason. Avoid stating that you will never pay if your real position is that you need an accurate balance, more time, or a lawful collection method.

Pay only through a verified company channel, obtain a receipt, and do not treat a collector’s promise to “delete” embarrassing material as proof that the account has been settled.

Common mistakes to avoid

Deleting messages, uninstalling the app, or changing phones before preserving evidence
Posting unredacted IDs, loan documents, contact numbers, or screenshots publicly
Complaining only through social media without creating proof of formal notice
Naming only the app brand and not trying to identify the legal company
Filing an NPC complaint immediately without addressing the 15-day exhaustion requirement or explaining why it should be waived
Submitting conclusions such as “they hacked me” without showing what data was accessed and how you learned of it
Cropping screenshots so tightly that the sender, date, time, and context disappear
Filing one SEC form against several different companies
Using an outdated NPC form
Assuming a privacy complaint cancels a valid debt
Sending further IDs, OTPs, passwords, or payments to someone whose authority has not been verified
Secretly altering evidence or presenting reconstructed messages as originals

When legal help is urgent

Consult a Philippine lawyer promptly if:

A credible threat of physical harm has been made
Intimate images, altered photographs, medical information, government IDs, or financial credentials were posted or distributed
Your identity or accounts were used without permission
Money was taken through an unauthorized transaction
A summons, subpoena, court pleading, or regulator’s order has arrived
Several companies or foreign operators are involved
The lender disputes that it controls the app or collection agency
You need an injunction, damages, criminal prosecution, or advice about a disputed contract
You have already filed related cases and must complete a certification against forum shopping accurately

Public Attorney’s Office assistance may be available to qualified persons. A lawyer can also assess possible civil or criminal remedies that depend on the exact messages, publication, harm, and identity of the responsible persons.

Frequently asked questions

Can a lending app contact everyone in my phonebook?

No. Unbridled or excessive processing of a contact list is prohibited. For debt collection, NPC rules allow contact with a person identified as a guarantor, not indiscriminate communication with relatives, friends, co-workers, or other saved contacts.

Can the app call my character reference about an unpaid loan?

A character reference is not automatically a guarantor. A reference may be contacted for legitimate verification purposes, but the reference cannot simply be treated as liable for the debt or used as a pressure point for collection.

Is contacting my employer always illegal?

Not automatically. The legality depends on the purpose, information disclosed, role of the recipient, and whether the communication was necessary and proportionate. Threatening your job, publicly shaming you, or disclosing debt information to unrelated co-workers may support an unfair-collection or privacy complaint.

Is repeated calling automatically harassment?

Not every repeated call is unlawful. Investigators will consider frequency, timing, language, purpose, whether you answered or requested a different channel, and whether calls were made to unrelated third parties. Keep a complete call log.

Do I still owe the loan if the app violated my privacy?

A privacy or collection violation does not automatically extinguish a valid loan. Liability for the debt and liability for unlawful collection are separate questions.

Can I file with both the SEC and NPC?

Yes, when the facts raise both unfair-collection and personal-data issues. Disclose related proceedings accurately wherever a form or certification requires it. Criminal conduct may also be reported to law enforcement.

Should I block the collector?

You may block an abusive number after preserving evidence, particularly for safety or peace of mind. Consider leaving one controlled written channel open for legitimate account notices, settlement discussions, and evidence of further conduct.

Can a relative or friend complain even if they are not the borrower?

Yes, if their own personal information was improperly processed or they personally received harassing collection communications. They should preserve the messages and describe how they are connected—or not connected—to the loan.

Where are the controlling official rules?

Key official sources include:

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. Procedures and conclusions may change or depend on the loan documents and complete facts. Official sources and filing channels were checked as of August 30, 2026.