Quick answer

Online lending app harassment can be reported to more than one agency because each handles a different problem:

Report abusive debt collection by a lending or financing company, its online platform, or its collection agency to the Securities and Exchange Commission (SEC).
Report unauthorized access, use, disclosure, or harvesting of contacts, photos, messages, or other personal data to the National Privacy Commission (NPC).
Report credible threats, extortion, stalking, impersonation, account intrusion, or other possible crimes promptly to the police or National Bureau of Investigation (NBI). Call 911 if anyone is in immediate danger.
If the lender is a bank or another BSP-supervised institution—not an ordinary SEC-regulated lending company—first complain to the institution, then escalate an unresolved complaint through the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism.

Save the evidence before deleting messages, uninstalling the app, changing devices, or blocking the collector. Harassment remains unlawful even when a debt is valid or overdue. Conversely, proving harassment or a privacy violation does not automatically cancel a legitimate loan.

What conduct may be reported

Unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing and lending companies—and persons collecting for them—from engaging in practices such as:

Threatening violence, property damage, reputational harm, or other criminal means;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing or disclosing a borrower’s name or personal information because of alleged nonpayment, except where disclosure is lawfully permitted;
Communicating false loan information, including failing to disclose that a debt is disputed when the rule requires that fact to be communicated;
Using false representations or deceptive collection methods;
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been past due for more than 15 days or the borrower gave appropriately recorded express consent that those hours are the only reasonable times for contact; and
Contacting people in the borrower’s contact list who were not named guarantors or co-makers, even if the borrower purportedly consented to access the list.

The late-hour exception does not authorize threats, insults, public shaming, deception, or contact-list harassment.

A collector may make a lawful demand for payment, explain the amount due, propose payment arrangements, or pursue a proper court remedy. A genuine threat to take lawful action is not automatically harassment. Fake court papers, false claims that the collector is a police officer or lawyer, or threats of an arrest that the collector has no authority to make are different matters.

The Constitution provides that no person may be imprisoned merely for debt. This does not protect separate criminal conduct, such as fraud or another independently punishable act. Any criminal liability depends on the actual facts and evidence. See Article III, Section 20 of the 1987 Constitution.

Privacy violations

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate to that purpose. Consent to install an app or allow one permission is not unlimited permission to use every item on the phone for harassment.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

An app may request access only when the data or permission is suitable, necessary, and not excessive for a legitimate purpose.
The lender should provide a “just-in-time” notice explaining how information will be processed at the point it is requested.
Camera or photo-gallery access may be used for legitimate purposes such as identity verification or payment verification, but should be turned off—or the user told it may be revoked—when no longer necessary.
A borrower’s photo must not be used to embarrass or harass the borrower into paying.
Unrestricted or disproportionate processing of a contact list is prohibited, particularly when it leads to harassment, unfair collection, or collection through people other than the borrower’s guarantors.
Limited access may be allowed to derive proportionate metadata or let the borrower select a character reference or guarantor through a separate interface. This does not permit indiscriminate copying or messaging of the entire contact list.
A character reference may be contacted to verify the borrower’s identity and the truth of information supplied during the application. A character reference is not automatically a guarantor.
A guarantor must have separately and expressly agreed to undertake the borrower’s obligation. For debt collection, the lender may contact that guarantor, but not other people found in the borrower’s contacts.

Privacy concerns may include:

Copying or uploading an entire contact list without a sufficient lawful purpose;
Messaging relatives, co-workers, clients, or friends about the debt;
Posting the borrower’s photograph, identification document, loan details, or altered “wanted” image;
Accessing photos, location data, messages, social-media contacts, or device information beyond what was properly disclosed and necessary;
Continuing to process data after permission has been revoked when no other lawful basis exists;
Refusing to identify the company controlling the data or explain who received it; or
Exposing the personal data of a character reference or another non-borrower.

Preserve evidence before taking other action

Make a separate evidence folder and keep an unedited backup. Preserve:

Full screenshots showing the message, sender’s number or account, date, and time;
Exported chats, emails, voicemail files, call logs, and original audio recordings already lawfully in your possession;
Screen recordings showing the app name, profile, message thread, URL, or social-media post;
The app-store listing, developer name, download link, app version, privacy notice, and permissions requested;
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, website, email addresses, and collection-agency name;
The loan agreement, disclosure statement, promissory note, repayment schedule, account statement, receipts, and proof of payments;
Copies of threats, fake legal documents, edited photographs, public posts, and messages sent to third parties;
Written statements and screenshots from relatives, employers, co-workers, or other contacts who received messages;
Proof that you disputed the debt, revoked consent, requested access or deletion, or asked the company to stop; and
A chronological log stating what happened, when, through which account, and who witnessed it.

Ask affected contacts to preserve what they received on their own devices. Avoid repeatedly forwarding humiliating material or posting it publicly; that can spread the privacy harm and expose unrelated people’s data.

Secure your phone and accounts

After preserving the evidence:

Review the app’s permissions and revoke unnecessary access to contacts, photos, camera, microphone, location, storage, and other protected resources.
Change passwords for email, banking, e-wallet, cloud-storage, and social-media accounts if compromise is possible. Enable multi-factor authentication.
Check account sessions and sign out unfamiliar devices.
Notify your bank, e-wallet provider, or telecommunications company immediately if there are unauthorized transactions, account takeover, or SIM-related problems.
Warn close contacts that fraudulent or abusive messages may arrive. Tell them not to send money, disclose information, or click links.
Remove the app if it is no longer needed and doing so will not destroy evidence. Uninstalling the app does not necessarily delete data already held by the lender.
Pay only through a verified company channel stated in reliable loan documents. Do not send money to a newly supplied personal account merely because a collector is threatening you.

Send a written complaint to the lender

For an NPC complaint, the general rule is that the affected person must first notify the company or other responsible entity in writing and give it an opportunity to act.

Send the complaint to the company’s customer-service address and, if available, its Data Protection Officer. Retain proof of delivery. State:

Your name and account or application reference;
The app and corporate lender involved;
The collector’s name, number, or account, if known;
The dates and exact conduct complained of;
Which personal data was accessed, used, or disclosed;
The people contacted and what they were told;
Whether the debt or amount is disputed;
The specific action requested; and
A request for a written response.

Depending on the facts, request that the company:

Stop the harassment and contact only you or a properly authorized representative;
Identify the lender, collection agency, and responsible personnel;
Provide the contents and sources of your personal data and identify its recipients;
Preserve relevant call recordings, system logs, instructions to collectors, and disclosure records;
Correct inaccurate loan or personal information;
Block, remove, or erase unlawfully obtained or unlawfully used data;
Notify recipients of a correction where appropriate; and
Provide an itemized computation of the amount claimed.

The right to erasure is not an automatic right to delete every record. A company may retain information when another lawful basis or legal retention obligation applies. The stronger demand is to stop unlawful processing and erase or block data that is unnecessary, excessive, unlawfully obtained, or used without authority. The NPC explains these rights in its Data Subject Rights guidance.

File an SEC complaint

Use the SEC route for unfair collection, an unauthorized lending operation, missing loan disclosures, or violations by a lending or financing company and its collectors.

The current online route is the SEC iMessage ticketing system. Select the service for Complaints on Financing and Lending Companies under the Financing and Lending Companies Department. The SEC’s official complaints page also provides the complaint form and filing guidance.

Prepare:

One complaint form for each respondent company;
A copy of a valid government-issued ID;
The evidence of harassment;
The loan contract, disclosure statement, repayment schedule, receipts, and proof of payment;
The app and collector details; and
A clear chronological narrative and requested action.

The SEC’s published procedure states that it may send the complaint to the company for an answer or comment, for which the company is given 10 days from receipt. An SEC complaint does not empower the agency to rewrite payment terms, declare the loan void, cancel the obligation, or settle the debt for the borrower. Those issues may require negotiation or appropriate judicial relief.

If the app does not conspicuously identify its corporate name, SEC registration number, and Certificate of Authority number, include that fact and screenshots in the report. Do not assume that an app-store listing proves authority to operate.

File an NPC complaint

Use the NPC route when you or another affected person suffered unauthorized or excessive processing, disclosure, contact-list harvesting, public shaming, or another violation of data-subject rights.

The 15-day prerequisite

Under the 2021 NPC Rules of Procedure, as amended, a complaint generally will not be given due course unless:

You informed the company or responsible entity of the privacy violation in writing; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days from receiving your written notice.

The NPC may waive this requirement for proven good cause or a serious violation—for example, grave and irreparable harm that only NPC action can prevent, the absence of a plain and adequate remedy from the respondent, or conduct that is patently illegal. Explain and document why a waiver is necessary rather than simply omitting the prior notice.

Formal filing requirements

Use the NPC Complaint-Affidavit template effective July 1, 2025. The previous form is no longer accepted.

The complaint generally must be:

Written, signed, verified, and notarized;
Filed by the affected data subject or a duly authorized representative;
Directed against an identified respondent—or explain facts that can lead to its identification;
Supported by a detailed factual narrative, documents, and witness affidavits when available;
Accompanied by correspondence with the respondent and its response, if any;
Clear about the relief requested; and
Accompanied by the required certification against forum shopping.

Disclose any related case filed in a court, the SEC, another tribunal, or another quasi-judicial agency. If you later learn of a same or similar action, the NPC rules require the fact to be reported to the NPC within five calendar days.

Follow the NPC’s current formal complaint instructions. A notarized complaint may be filed personally, sent by courier, or scanned and emailed to complaints@privacy.gov.ph. Filing fees may apply; government complainants, qualified indigent complainants, and persons granted a waiver for good cause may be exempt under the applicable rules. Check the NPC website before a physical filing because its office address and receiving arrangements may change.

A contact, character reference, co-worker, or relative whose own data was mishandled may file as an affected data subject even if that person did not borrow money.

Report threats and possible crimes

Do not wait for an SEC or NPC case if there is:

A credible threat of violence or property damage;
Extortion or a demand backed by an unlawful threat;
Stalking or an intimidating visit to a home or workplace;
Impersonation of police, court personnel, government officers, or lawyers;
A fake warrant, summons, subpoena, or criminal case notice;
Unauthorized access to an account or device;
Identity theft or fraudulent use of an ID;
Publication of sexual or intimate material; or
An immediate risk to a child or vulnerable person.

Call 911 for immediate danger. Otherwise, bring the evidence and identification to the nearest police station or NBI office. The NBI provides an online complaint page and investigative assistance through its Cybercrime Division.

Possible criminal charges depend on the exact words, conduct, intent, identity of the sender, and admissible evidence. Describe the facts rather than insisting on a particular offense. Keep the original device available because investigators may need it to authenticate the communications.

When the BSP is the proper regulator

Ordinary lending and financing companies, online lending platforms, and their collection agencies are generally referred to the SEC. The BSP’s own complaint guidance confirms this division.

Use the BSP route when the provider is a BSP-supervised financial institution, such as a bank or another institution within BSP supervision. First use that institution’s consumer-assistance channel. If the matter remains unresolved, escalate it through BSP Online Buddy or the BSP Consumer Assistance Mechanism.

A familiar e-wallet or payment channel does not necessarily mean that the lender itself is BSP-supervised. Identify the entity that actually extended the loan.

Common mistakes to avoid

Deleting the app or messages before preserving evidence;
Submitting cropped screenshots that omit the sender, date, time, or surrounding conversation;
Naming only the app and not the corporate lender or collection agency;
Filing a general email with the NPC instead of the current notarized Complaint-Affidavit;
Failing to notify the company in writing and document the 15-day period for an NPC complaint;
Omitting related proceedings from the certification against forum shopping;
Assuming that app permission authorizes unlimited contact-list use;
Assuming that harassment automatically extinguishes the debt;
Paying an unverified personal account under pressure;
Publicly reposting IDs, phone numbers, loan documents, or contact lists while seeking help; or
Ignoring genuine court papers because earlier messages were fake.

Verify a supposed summons directly with the named court using official judiciary contact information. Do not use the collector’s supplied number for verification. Calendar every deadline stated in genuine papers and obtain legal advice promptly.

When legal help is urgent

Consult a lawyer immediately if a case has been filed, a genuine summons or subpoena was served, the lender is threatening foreclosure or repossession, a large amount is disputed, your identity was used for another loan, or the harassment has caused serious financial, employment, medical, or safety consequences.

Qualified indigent persons may seek free assistance from the Public Attorney’s Office. Bring identification, proof of income or qualification, loan records, your chronology, and all preserved communications.

Frequently asked questions

Can a collector contact my employer, family, or friends?

Generally, a lender may not use people found in your contact list to collect from you. A properly consenting guarantor may be contacted about the guaranteed obligation. A character reference may be contacted for identity and application verification, but is not automatically a guarantor and should not be used as a collection target. Limited disclosures specifically authorized by law are fact-dependent.

I allowed contact access when I installed the app. Did I waive my rights?

No. Permission does not excuse excessive, undisclosed, disproportionate, or harassing processing. SEC rules also prohibit contacting non-guarantor or non-co-maker contacts for collection despite purported borrower consent.

Can I complain even if the loan is overdue?

Yes. A creditor may pursue lawful collection, but overdue status does not authorize threats, insults, deception, public shaming, or prohibited use of personal data.

Does filing a complaint stop interest or collection?

Not automatically. Request a written statement of account and dispute incorrect charges, but continue addressing any legitimate obligation through safe, documented channels. Obtain legal advice if the validity, interest, fees, or enforceability of the loan is disputed.

Should I block the collector?

Preserve the evidence first. Blocking may reduce immediate distress, but provide the company with one safe written channel if you want legitimate account communications. Do not engage with abusive messages merely to collect more evidence.

Can someone who never borrowed file a privacy complaint?

Yes, if that person’s own personal data was improperly collected, used, or disclosed. This can include a character reference, contact-list entry, relative, co-worker, or recipient of a message that exposed personal data.

Must I wait 15 days before reporting threats?

No. The 15-day rule concerns the usual exhaustion requirement for a formal NPC privacy complaint. Credible threats and urgent criminal or safety concerns should be reported to law enforcement immediately. You may also ask the NPC to waive prior exhaustion when the amended rules’ conditions are properly alleged and proved.

Will the SEC or NPC erase my debt?

No. These agencies may address regulatory or privacy violations, but a complaint does not by itself cancel a loan. The SEC expressly states that it cannot cancel or settle the borrower’s obligation or declare the contract void.

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the loan documents, identity and regulatory status of the lender, exact communications, and available evidence. Laws, procedures, forms, fees, addresses, and online channels were checked against official sources as of August 6, 2026.