Quick answer

If an online lending app or its collector threatens you, publicly shames you, insults you, contacts people in your phonebook, or misuses your photos or other personal data:

Preserve the evidence before blocking, deleting, or uninstalling anything.
Revoke unnecessary app permissions and secure your accounts.
Send the lender or its data protection officer a written complaint and demand that the unlawful conduct stop.
Report unfair collection practices to the Securities and Exchange Commission (SEC) through the SEC iMessage portal.
Report unauthorized or excessive use or disclosure of personal data to the National Privacy Commission (NPC). As a general rule, first notify the company in writing and allow it 15 calendar days to take appropriate action before filing the formal NPC complaint.
Report threats, extortion, fraud, impersonation, or other possible crimes immediately to the police, NBI, PNP Anti-Cybercrime Group, or DICT Cyber Hotline. Do not wait 15 days if anyone is in immediate danger.

The same incident may properly be reported to more than one agency because debt-collection regulation, data privacy, and criminal law address different misconduct. Reporting harassment does not automatically cancel a valid loan, but owing money does not authorize threats, humiliation, or unlawful access to other people’s data.

What online lenders and collectors are prohibited from doing

SEC Memorandum Circular No. 18, series of 2019 applies to financing companies, lending companies, and third-party collection providers acting for them. It prohibits practices including:

Threatening violence or other criminal means against a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that amounts to abuse or an offense;
Publishing or disclosing a borrower’s name or personal information outside legally permitted circumstances;
Communicating information known, or which should be known, to be false—including failing to say that a debt is disputed when communicating about it;
Using false representations or deceptive methods to collect a debt or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed, through written, electronic, or recorded means, that those are the only reasonable contact times; and
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, even if the lender claims the borrower consented to phonebook access.

The lender remains responsible for collection practices even when it hires an outside collector.

Under the Data Privacy Act and the NPC’s loan-related data-processing rules, an app may not collect or use personal data simply because it is technically able to do so. Processing must have a lawful basis and be transparent, necessary, proportionate, and limited to a legitimate purpose.

The March 2026 joint advisory of the DICT, NPC, and SEC specifically reiterates that:

Unnecessary app permissions and unnecessary processing are prohibited;
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited;
Contact-list data must not be used to harass or collect from people outside the borrower’s guarantors;
Character references are for identity or information verification, not debt collection;
A person is not a guarantor merely because their number appears in the borrower’s phonebook or was submitted as a reference; the person must have consented to assume that responsibility;
A borrower’s photograph must not be used to harass or embarrass the borrower;
Camera, gallery, and similar permissions should be limited to the stage when they are genuinely needed and should be turned off or revocable after the purpose is completed; and
Personal data must not be kept indefinitely. It may be retained only while necessary for the original purpose, legal claims, or a retention duty imposed by law.

These rules apply to entities acting as lenders even when they lack the required SEC authority. Being unregistered does not place an operator outside the Data Privacy Act.

Which agency should receive the report?

Problem	Where to report
Threats, insults, public shaming, deceptive collection, contacting unrelated people, or other unfair collection conduct by a lending or financing company	SEC Financing and Lending Companies Department through SEC iMessage
Unauthorized access to contacts, excessive app permissions, disclosure of loan information, misuse of photos, or denial of data-subject rights	National Privacy Commission
Complaint against a bank, e-money issuer, pawnshop, payment-system operator, or another BSP-supervised institution	First use the institution’s consumer-assistance channel, then escalate through the BSP Consumer Assistance Mechanism
Threats, extortion, fraud, impersonation, account takeover, or other possible crimes	Local police, NBI Cybercrime Division, PNP Anti-Cybercrime Group, or DICT Cyber Hotline
Immediate danger or a credible threat of physical harm	Call 911 or go to the nearest police station immediately

An app-store report may help remove a harmful app, but it is not a substitute for an SEC, NPC, BSP, or law-enforcement complaint.

What to do immediately

1. Preserve evidence before deleting anything

Save the evidence in its original form whenever possible. Keep at least one backup outside the affected phone.

Preserve:

Complete screenshots showing the sender, phone number or account, date, time, and full message;
The original SMS, email, chat, direct message, voice message, or publicly visible post;
A screen recording showing the conversation or post in context;
URLs, profile links, usernames, account identifiers, and phone numbers;
The app’s exact name, developer, package identifier, download page, version, and privacy notice;
Screenshots of every permission requested or granted;
The loan agreement, disclosure statement, repayment schedule, account statement, receipts, and proof of payment;
Names or aliases used by collectors and any company or collection agency they identified;
Bank, e-wallet, or payment-account details to which payment was demanded;
Messages received by relatives, colleagues, employers, or other contacts;
Proof that any statement communicated about you was false or that the debt was already disputed;
Your written complaint to the company, proof of delivery, and its response; and
Reference numbers and acknowledgments from every agency contacted.

Ask affected contacts to preserve their own original messages. Their signed affidavits may later be useful.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act can apply to unauthorized recording. Preserve voicemails and recordings already lawfully obtained.

2. Stop further unnecessary access

After documenting the current permissions:

Turn off access to contacts, camera, photos, files, location, microphone, call logs, and SMS unless a permission remains genuinely necessary;
Change passwords if you reused a password in the app or disclosed credentials;
Enable multi-factor authentication on email, social media, banking, and e-wallet accounts;
Review logged-in devices and account-recovery details;
Warn contacts not to disclose information, send money, or click links from collectors; and
Consider uninstalling the app after preserving its identifying information and evidence.

Revoking permission or uninstalling the app may stop future device access, but it does not erase data the operator already copied.

3. Identify the actual company

The app name may be different from the lender’s corporate name. Check:

The loan contract and disclosure statement;
The app-store developer details;
The privacy notice and terms of service;
Payment instructions and receipts;
SEC registration and Certificate of Authority information; and
SEC advisories concerning unauthorized, suspended, or revoked operators.

Record both the app name and every possible corporate or trade name. If the operator cannot be identified, report all available identifiers rather than guessing.

4. Send a written notice to the company

Send the notice to customer service, the official complaints channel, and the data protection officer listed in the privacy notice. Use email or another method that produces proof of delivery.

State:

Your name and account or loan reference;
The dates and exact acts complained of;
The collector’s number, username, or claimed identity;
Which contacts, photos, messages, or other data were accessed or disclosed;
That the debt is disputed, if applicable, and the specific reason;
That third-party contact, public disclosure, threats, and other unlawful processing must stop;
That future communications should be sent directly to you through a specified written channel;
A request to identify the legal lender, collection agency, and responsible data controller;
A request for the source, categories, purposes, recipients, and retention period of the personal data being processed;
A request to correct false data and delete or block data that has no lawful basis, subject to lawful retention requirements;
A request for a complete statement of account; and
A reasonable deadline for written confirmation.

Do not demand destruction of evidence relevant to your complaint. A lender may also retain some records when required by law or reasonably necessary to establish, exercise, or defend legal claims.

How to file an SEC complaint

Since November 2024, complaints against financing and lending companies—including their online lending apps and platforms—are filed through the SEC iMessage portal.

Choose the service for the Financing and Lending Companies Department (FinLenD) and provide:

Your complete and accurate contact information;
The corporate name and app or platform name;
A concise chronological account of what happened;
The loan or account details needed to identify the transaction;
A valid government-issued ID;
The loan agreement, disclosure statement, account statement, receipts, and other relevant documents;
Screenshots, messages, posts, and evidence from affected contacts; and
The specific remedy or regulatory action you are requesting.

Submit a separate complaint for each respondent company and keep the ticket or reference number.

The SEC can investigate regulatory violations and impose administrative sanctions. It does not ordinarily use this complaint process to rewrite payment terms, declare an interest provision void, cancel a loan, or settle the borrower’s account.

Under SEC Memorandum Circular No. 18, the listed penalties for a first and second offense are ₱25,000 and ₱50,000 for lending companies, and ₱50,000 and ₱100,000 for financing companies. For a third offense, depending on its facts and gravity, the SEC may impose a fine of at least twice the second-offense fine but not more than ₱1 million, suspend lending or financing activities for 60 days, or revoke the company’s Certificate of Authority. For this purpose, violations are counted per loan transaction per complainant—not as a separate violation for every harassing message. Other laws and sanctions may also apply.

How to file an NPC complaint

Complete the required first step

Under the current NPC Rules of Procedure, a formal complaint generally will not be given due course unless you show that:

You informed the lender, collection provider, or other responsible entity in writing about the privacy violation; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive this requirement for properly proved good cause or a serious violation—for example, where NPC action is needed to prevent grave and irreparable harm, the respondent cannot provide a plain and adequate remedy, or the conduct is patently illegal. Explain and document why a waiver is necessary instead of merely skipping the written-notice step.

The current rules do not state the former six-month/30-day administrative filing limit found in the superseded 2016 procedure. Nevertheless, file promptly: delay can weaken evidence, and separate prescriptive periods may apply to criminal or civil remedies.

Prepare the formal complaint

Use the NPC’s Complaints-Assisted Form and filing instructions. The complaint must ordinarily be signed, verified, and notarized.

Include:

Your identity and contact details;
The respondent’s identity and service address, if known;
A chronological statement of material facts;
The Data Privacy Act, NPC rule, or data-subject right allegedly violated;
The relief requested;
All correspondence with the respondent and proof of delivery;
Copies of supporting documents;
Witness affidavits, if available;
A valid government-issued ID; and
The required certification against forum shopping.

File one complaint form per respondent. If you have also complained to the SEC, BSP, police, a court, or another tribunal, disclose the filing accurately where the form or certification requires it. Do not conceal parallel proceedings involving the same issues.

Submit and pay the applicable fee

The NPC accepts complaints personally, by registered mail, by courier, or through authorized electronic filing. The NPC currently instructs complainants to send the scanned notarized form and supporting documents to complaints@privacy.gov.ph. Use readable PDF files and retain the sent email and acknowledgment.

NPC Circular No. 2023-01 lists a base complaint filing fee of ₱500, with additional fees for claims for damages and certain interim applications. Indigent complainants may qualify for an exemption, and the NPC may waive fees for good cause upon proper request. Follow the NPC’s official assessment and payment instructions; do not pay through an unofficial account.

The investigating officer has 30 calendar days from receipt to determine whether to give the complaint due course or dismiss it without prejudice. That is an initial evaluation period, not a deadline for final resolution.

If unlawful processing is continuing and causing grave harm, ask the NPC or a lawyer about an application for a temporary ban on processing. It requires specific facts, supporting evidence, a notarized application, applicable fees, and ordinarily a bond; it is not granted automatically.

Reporting threats, fraud, or other possible crimes

Do not wait for the SEC or NPC process where there is a credible threat, extortion demand, identity theft, account takeover, impersonation, publication of intimate material, or another possible crime.

The March 2026 joint government advisory identifies these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491
NBI online complaint page: nbi.gov.ph/online-complaint

Bring the affected device, original files, identification, a factual chronology, loan documents, and proof connecting the numbers or accounts to the incident. Avoid editing screenshots or forwarding evidence in a way that destroys metadata.

For an immediate or credible threat of physical harm, call 911 or proceed to the nearest police station.

If the provider is regulated by the BSP

The SEC route is generally for lending and financing companies. If the product was provided by a bank, non-bank electronic-money issuer, pawnshop, money-service business, payment-system operator, or another BSP-supervised institution:

File first with the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.
If its response is unsatisfactory, escalate through the BSP Online Buddy on the BSP website or the BSP’s official Facebook page.
If you cannot use the chatbot, complete the BSP complaint form and email it, with proof of your first-level complaint, to consumeraffairs@bsp.gov.ph.

The BSP Consumer Assistance Mechanism handles complaints against BSP-supervised institutions; it is not a substitute for an NPC complaint about unlawful personal-data processing or a criminal report concerning threats.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence;
Sending payment to a collector’s personal e-wallet without verifying the creditor and official payment channel;
Assuming the app’s display name is the lender’s legal corporate name;
Filing only an app-store report;
Filing an NPC complaint without proving written notice and the 15-day waiting period—or without explaining and proving why the NPC should waive it;
Combining unrelated companies in one complaint form;
Posting the collector’s personal information publicly and creating a separate privacy or defamation dispute;
Exaggerating facts, altering screenshots, or omitting payments already made;
Concealing other complaints or cases in the certification against forum shopping;
Treating a character reference as automatically liable for the debt; and
Assuming harassment automatically erases the loan.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a summons, subpoena, warrant, court pleading, or formal demand requiring a response;
The collector threatens violence, has located your home or workplace, or appears capable of carrying out the threat;
Intimate images, children’s information, government IDs, financial credentials, or medical information were disclosed;
The app used your identity to obtain another loan or take over an account;
A large amount is disputed or the loan documents appear falsified;
You are considering a temporary processing ban, damages claim, injunction, or criminal complaint;
Several agencies or cases involve substantially the same issues; or
You are being pressured to sign a waiver, admission, settlement, or new promissory note.

Frequently asked questions

Can an online lender contact my family, friends, employer, or coworkers?

Not merely because their details appear in your phonebook. For collection purposes, the current joint advisory says the lender may contact a person who validly consented to be your guarantor. A character reference may be contacted for identity or information verification, not to pressure that person into paying or to shame you. SEC rules also recognize properly named guarantors or co-makers, but consent to general phonebook access does not authorize contacting everyone listed there.

Can the lender post my photo or call me a scammer?

A lender may not use your photo to harass or embarrass you. Publishing your name, photograph, loan information, or accusations to shame you may violate SEC collection rules, the Data Privacy Act, or other laws. Whether a particular statement is also criminally actionable depends on its exact words, audience, truth or falsity, and surrounding facts.

Does clicking “Allow contacts” make the harassment legal?

No. Consent must be informed, specific, freely given, and connected to a legitimate purpose. SEC rules prohibit contacting unrelated people in the borrower’s contact list notwithstanding purported consent. NPC rules also prohibit unbridled, excessive, or disproportionate contact-list processing.

Can I be imprisoned for failing to pay an online loan?

The 1987 Constitution states that no person may be imprisoned for debt. Ordinary inability or failure to pay a contractual loan is not, by itself, a basis for imprisonment. This does not prevent a creditor from pursuing lawful civil remedies, and it does not protect separate criminal conduct—such as proven fraud—from prosecution.

Should I stop paying after reporting the lender?

A harassment or privacy complaint does not by itself suspend or cancel a valid debt. Ask for a complete statement of account, dispute incorrect charges in writing, and pay only through a verified official channel. Obtain legal advice before withholding payment based on an alleged defect in the contract.

Can I complain if the loan is already paid or was never mine?

Yes. Payment does not excuse earlier harassment or unlawful disclosure. If the loan was created through identity theft, dispute it immediately, preserve proof that you did not apply, secure your accounts, and report both the privacy violation and possible crime.

Can I block the collector?

Yes, after preserving the evidence. Tell the company in writing where legitimate account communications may be sent. Blocking one abusive number does not prevent the lender from using reasonable, lawful collection methods.

Do I need a lawyer to report the incident?

A lawyer is not required to open an SEC iMessage ticket or to use the NPC Complaints-Assisted Form. However, an NPC complaint is a formal verified proceeding with evidence, notarization, fees, and a certification against forum shopping. Legal help is advisable where the facts are complex, significant damages are claimed, interim relief is needed, or other cases are already pending.

Official legal and filing sources

This article provides general Philippine legal information, not legal advice for a specific case. Outcomes depend on the loan documents, communications, identities of the parties, evidence, and applicable regulator. Laws, procedures, contact details, and official guidance were checked as of 6 August 2026.