Quick answer

You may report abusive online-loan collection to the Securities and Exchange Commission (SEC), misuse of personal data to the National Privacy Commission (NPC), and threats or other possible crimes to the PNP or National Bureau of Investigation (NBI). If the lender is a bank, digital bank, e-money issuer, pawnshop, or another BSP-supervised institution, use its complaint channel first and then escalate to the Bangko Sentral ng Pilipinas (BSP).

Save the evidence before blocking numbers, revoking permissions, or uninstalling the app. For an NPC complaint, you must ordinarily notify the lender or its data protection officer in writing and allow 15 calendar days from receipt for an appropriate response. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, no adequate remedy, or patently illegal conduct.

A legitimate debt may still be collected through lawful means, but it does not authorize threats, insults, public shaming, false representations, or uncontrolled use of your contacts, photographs, and other personal data.

What collectors may—and may not—do

A lender may send an accurate payment reminder, demand payment, offer restructuring, use a legitimate collection agency, or file an appropriate civil action. A firm but professional demand is not automatically harassment.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited collection conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or improperly disclosing a borrower’s name or personal information.
Communicating loan information known—or that should be known—to be false, including concealing that a debt is disputed.
Using false representations or deceptive means to collect or obtain information.
Contacting people in the borrower’s contact list who are not genuine guarantors, co-makers, or otherwise legally bound to the loan.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions when the account is more than 15 days past due or the borrower has expressly agreed that those are the only reasonable times. Those exceptions do not permit threats, deception, shaming, or unlawful disclosure.

Collectors should not claim that they have already obtained an arrest warrant, court judgment, or government order when that is untrue. A barangay, collection agency, lawyer, or lender cannot itself issue an arrest warrant.

The Constitution provides that no person may be imprisoned merely for debt. This does not excuse fraud or another independently punishable act, and it does not justify ignoring a genuine summons, subpoena, or court order. See Article III, Section 20 of the 1987 Constitution.

Privacy rules specific to lending apps

The Data Privacy Act of 2012 requires personal data to be processed fairly, lawfully, transparently, for a legitimate purpose, and only to a proportionate extent.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

An app may not require unnecessary or excessive permissions.
Access to contacts, cameras, photographs, and other protected resources must be suitable, necessary, and proportionate to a legitimate purpose.
Processing through a permission should begin only when the information is actually needed. Once the purpose has been completed and no other lawful basis applies, the app should turn off the permission or tell the user that it may be revoked.
A borrower’s photograph may not be used to embarrass or harass the borrower during collection.
Uncontrolled or disproportionate processing of an entire contact list is prohibited. This includes processing that leads to harassment, collection from people other than valid guarantors, or another unfair collection practice.
Limited contact-list access may be used to let the borrower select a character reference or guarantor, or to derive proportionate metadata when legally permitted. This is not permission to copy the entire list and message everyone.
A character reference may be contacted only to verify the applicant’s identity and the truth of information supplied for the application. A character reference is not automatically a guarantor and must be allowed to request removal of their data as a reference.
A guarantor must have separately and expressly agreed to that role. A name appearing in a phonebook or application form does not, by itself, make that person liable for the debt.
Consent to an app permission does not waive the prohibitions against unfair collection, excessive processing, or debt shaming.

The lender remains accountable for personal data processed by an outsourced collector or service provider acting for it.

What to do immediately

1. Preserve the evidence

Before deleting anything, save:

Full screenshots of messages, posts, comments, emails, and app notifications, showing the sender, account name or number, date, and time.
The URL and profile details of every social-media account used.
Call logs, voicemails, and text-message details.
Screenshots of the app’s permissions, privacy notice, developer page, app-store listing, and requested access.
The loan agreement, disclosure statement, payment schedule, receipts, account statement, and collection notices.
The corporate name, SEC registration number, Certificate of Authority number, office address, data protection officer, and collection agency shown in the documents.
Messages received by relatives, co-workers, employers, or other contacts. Ask each recipient to keep the original message and write a short signed account of what was received and when.
Proof of harm, such as employer correspondence, medical or counseling records, fraudulent transactions, security expenses, or costs incurred in responding.

Keep the originals and a backup. Avoid editing, annotating, or cropping the only copy. Export chats where the platform permits it.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally requires authorization from all parties to record a private communication. Preserve voicemails and recordings voluntarily sent to you.

2. Secure your phone and accounts

After preserving the evidence:

Revoke the app’s access to contacts, photos, camera, microphone, storage, location, SMS, and call information unless access remains genuinely necessary.
Change any password or PIN that may have been exposed, especially if reused elsewhere.
Enable multi-factor authentication on email, social-media, banking, and e-wallet accounts.
Check for unfamiliar logins, transactions, loans, or SIM-related activity.
Tell affected contacts not to provide information, send money, click links, or engage with the collector.
Uninstall the app if it is no longer needed, but remember that uninstalling does not erase data already uploaded to the lender’s servers or cancel the loan.

Do not pay an unfamiliar personal account simply because a caller demands it. Verify the lender and payment channel against the contract, request an updated statement, and obtain an official receipt.

3. Identify the company behind the app

The app’s trade name may differ from the legal lender. Check:

The loan agreement and disclosure statement.
The app’s privacy notice and terms.
The app-store developer information.
Collection emails, official receipts, and payment-account names.
The SEC’s Check with SEC service.

Verify both the corporation’s registration and its authority to operate as a lending or financing company. App-store availability, a social-media page, or an SEC corporation registration alone does not prove authority to lend.

Send a written notice to the lender

Address the notice to the company and, if available, its data protection officer. Send it through a traceable channel and retain proof of delivery.

Subject: Notice of collection harassment and privacy violation

I am [name], associated with loan account/application [reference number]. On [dates and times], your personnel, collector, or service provider [identify numbers/accounts] committed the following acts: [brief chronological facts].

Personal data involved include [contacts, photograph, loan information, employer details, or other data]. I did not authorize its use or disclosure for harassment or collection from third parties.

Please immediately stop unlawful collection and third-party contact; preserve all records relating to these incidents; identify the company, collector, and data protection officer responsible; disclose the personal data processed, its source, purpose, recipients, and retention period; correct any false information; and block, remove, or destroy unlawfully processed data where required by law.

Please confirm your action in writing. I reserve my rights before the SEC, NPC, law-enforcement agencies, and the courts. This notice does not waive any genuine dispute concerning the loan amount, charges, payment history, or identity of the creditor.

Do not include an OTP, account password, banking PIN, or more identification data than reasonably necessary.

Where to report the conduct

Agency	Use it for	Current route
SEC	Harassment or unfair collection by a lending or financing company; undisclosed lender identity; operation without proper authority	File with the Financial and Lending Company Division through flcd_complaints@sec.gov.ph or submit a ticket through SEC iMessage
NPC	Misuse or excessive collection of contacts, photos, IDs, loan information, or other personal data; third-party disclosure; debt shaming	Use the NPC’s formal complaint page and current form and submit to complaints@privacy.gov.ph
BSP	Conduct by a bank, digital bank, non-bank e-money issuer, pawnshop, money-service business, operator of a payment system, or another BSP-supervised institution	Complain to the institution first, then use BSP Consumer Assistance or email consumeraffairs@bsp.gov.ph
PNP/NBI	Credible threats, stalking, extortion, impersonation, account intrusion, forged documents, or other possible crimes	Go to the nearest police station or use the NBI’s online complaint page or Cybercrime Division
DOJ Office of Cybercrime	Cybercrime reporting or referral assistance	Follow the DOJ’s cybercrime reporting guidance

The same incident may justify reports to more than one agency because SEC regulation, privacy enforcement, and criminal investigation serve different purposes.

How to file the SEC complaint

Use the SEC’s prescribed complaint form and submit one complaint form for each respondent company. Include:

Your complete and accurate contact details.
A copy of a valid government-issued ID.
The app name and the lender’s legal corporate name.
A clear, chronological account of the collection conduct.
The phone numbers, accounts, collectors, and collection agency involved.
Your contract, disclosure statement, receipts, statement of account, and payment records.
Screenshots and statements from third-party recipients.
Proof that the company is unregistered, unauthorized, suspended, or revoked, if applicable.

The SEC’s lending and financing complaint guidance states that the respondent is generally furnished a copy and given 10 days from receipt to answer or comment.

The SEC may investigate and impose appropriate administrative sanctions, but its complaint process does not itself cancel the loan, rewrite payment terms, declare the contract void, or conclusively determine that an interest provision is invalid.

How to file the NPC complaint

The 15-day prior-notice rule

Ordinarily, you must first inform the lender, collector, personal information controller, or processor in writing of the privacy violation. Attach proof that:

The respondent received the notice; and
It failed to take timely or appropriate action, or failed to respond within 15 calendar days.

The NPC may waive this exhaustion requirement at its discretion if properly justified—for example, where only immediate NPC action can prevent grave and irreparable harm, the respondent cannot provide a plain and adequate remedy, or the conduct is patently illegal. Explain the urgency and attach proof rather than simply omitting the prior notice.

Required form and attachments

Use the NPC’s current Complaint-Affidavit form. Complete it accurately, sign the verification and certification against forum shopping, have it notarized, and attach:

A valid government-issued ID.
The respondent’s identity and address, if known.
A list of the personal data processed.
A chronological narration identifying each disclosure or unauthorized use.
The written notice to the respondent and proof of receipt.
The respondent’s answer, if any.
Screenshots, documents, and witness affidavits.
The relief requested, such as stopping third-party contact, blocking unlawful processing, correction, deletion where legally proper, indemnity, or another appropriate order.

If the legal operator is unknown, describe the app, developer, payment accounts, phone numbers, websites, and other facts that may identify it.

The complaint may be submitted personally, by courier, or by emailing a scanned completed complaint to complaints@privacy.gov.ph, following the current instructions on the NPC filing page. The current form lists the NPC at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103.

Under the currently posted NPC fee schedule, the basic complaint filing fee is ₱500, with a separate legal-research fee and possible additional fees for damages or special relief. Indigent litigants may qualify for exemption if their family income does not exceed twice the applicable monthly minimum wage and they do not own real property with a fair market value above ₱300,000, subject to the required barangay certificate, affidavits, and tax declaration.

If upheld, an NPC complaint may result in compliance orders, indemnity where supported, administrative fines, a ban on processing, or referral to the Department of Justice for possible prosecution. A favorable result is not automatic; liability and relief depend on the evidence and applicable legal basis.

If the lender is BSP-supervised

A loan accessed through an app may actually be issued by a bank, digital bank, or another BSP-supervised institution rather than an SEC-regulated lending company.

First use the institution’s Financial Consumer Protection Assistance Mechanism and obtain a reference number or proof of receipt. If its response is absent or unsatisfactory, escalate through the BSP Consumer Assistance Mechanism. Attach your complaint to the institution, its response, identification, supporting records, and the specific resolution requested.

The BSP route does not replace an NPC complaint when personal data was misused or a police report when threats may constitute a crime.

When to involve the police or NBI immediately

Do not wait for the 15-day NPC response period when there is an immediate safety or criminal concern. Seek law-enforcement assistance promptly if the collector:

Threatens physical injury, abduction, sexual violence, or damage to property.
Publishes your home address or encourages others to confront you.
Stalks you or appears at your home or workplace in a threatening manner.
Demands money through blackmail or threatens to release intimate material.
Takes over an account, uses stolen identity documents, or opens unauthorized financial accounts.
Sends forged warrants, court orders, police documents, or government identification.
Targets a child or another vulnerable person.
Is actively deleting accounts or messages that may be evidence.

Online conduct may implicate the Cybercrime Prevention Act and existing penal laws, but the exact offense depends on the words used, intent, surrounding facts, and evidence. Avoid assigning a criminal label yourself; describe precisely what happened and let investigators and prosecutors assess the charge.

Common mistakes to avoid

Deleting the app or messages before saving evidence. Preserve first, then secure the device.
Reporting only the app’s brand name. Identify the legal lender, developer, collector, and payment-account holder where possible.
Submitting cropped screenshots with no sender, date, or context. Keep full-screen and original copies.
Calling the conduct “harassment” without describing it. Quote the relevant words, identify the recipient, and state when and how each act occurred.
Skipping the written notice before an NPC complaint without explaining urgency. This may lead to dismissal unless the NPC waives the requirement.
Assuming permission to access contacts is unlimited consent. Current rules still require necessity and proportionality and prohibit unfair collection.
Secretly recording private calls. Preserve lawful evidence and obtain advice before recording.
Publicly retaliating against individual collectors. Posting their unverified personal information may create separate privacy or defamation issues.
Paying an unverified personal account. Confirm the creditor, balance, and official payment channel.
Ignoring genuine legal documents. Verify them with the issuing court or agency and obtain legal help promptly.
Assuming a complaint automatically erases the debt. Collection misconduct and the validity or amount of the obligation are separate questions.

Frequently asked questions

Can the lender contact my family, employer, or co-workers?

Not merely because their numbers appear in your phone. For collection purposes, third-party contact and disclosure are generally prohibited unless the person has a separate lawful role, such as a valid guarantor or co-maker. Even then, the communication must be limited, accurate, and lawful.

Can a character reference be forced to pay?

No. A character reference is not automatically a guarantor. A guarantor must separately and expressly agree to the guaranty required by law.

I allowed contact access when installing the app. Can I still complain?

Yes. Consent must be specific and informed, and processing must remain necessary and proportionate. Consent does not legalize threats, debt shaming, unrestricted copying of contacts, or disclosure for an unauthorized purpose.

Can someone who is not the borrower file a privacy complaint?

Yes, if that person’s own personal data was collected, used, or disclosed improperly. A contacted friend, relative, co-worker, or character reference may be a data subject with an independent complaint.

Does revoking permission delete previously uploaded contacts?

No. Revocation normally stops further access from the device; it does not necessarily erase copies already stored. Send a written data-subject request asking what was collected, its source, recipients, purpose, and retention period, and request blocking or deletion where the legal requirements are met.

Must I wait 15 days before every report?

The 15-calendar-day period ordinarily applies to exhaustion of remedies before a formal NPC complaint. It does not prevent an immediate SEC report or police/NBI report. The NPC may also waive exhaustion for a properly proven serious or urgent case.

Can a collector have me arrested for an unpaid app loan?

A collector cannot issue an arrest warrant, and nonpayment of debt alone is not a ground for imprisonment. Separate alleged criminal conduct is different, and a genuine summons, subpoena, or warrant must be verified and addressed.

Will reporting harassment cancel the loan?

No. A regulatory or privacy complaint does not automatically cancel a valid obligation. Continue requesting an accurate statement and use lawful payment or dispute channels while the complaint is pending.

Is there a guaranteed time for the agencies to resolve my complaint?

No. The 15-day NPC period concerns the respondent’s opportunity to address the privacy complaint before filing; it is not a guaranteed NPC resolution period. The SEC’s 10-day period is generally the respondent’s time to answer after receiving the complaint. Investigation and adjudication may take longer.

Official sources

This article provides general legal information, not legal advice. The correct remedy may depend on the loan documents, the lender’s regulatory status, the exact communications, and how personal data was obtained or disclosed. Official sources and procedures were checked on 26 August 2026.