Quick answer

You may report online lending app harassment to the Securities and Exchange Commission (SEC), privacy violations to the National Privacy Commission (NPC), and threats, fraud, extortion, or other possible crimes to law-enforcement authorities. If the lender is a bank, digital bank, or another institution supervised by the Bangko Sentral ng Pilipinas (BSP), use the institution’s complaint channel first, then escalate to the BSP.

A lender may demand payment through lawful and reasonable means. It may not use threats, public shaming, abusive language, deception, or your phone contacts and photos to humiliate you. Contacting people from your contact list for debt collection is prohibited unless the person is an actual guarantor who separately consented to that role. A character reference is not automatically a guarantor.

Reporting harassment does not automatically erase, suspend, or cancel a valid loan. Preserve your evidence, secure your phone, dispute incorrect amounts in writing, and continue dealing only through verified official payment and complaint channels.

Conduct you can report

Under SEC Memorandum Circular No. 18, series of 2019, prohibited or unfair collection practices include:

Threatening violence, property damage, reputational harm, or another criminal act.
Threatening an action that cannot legally be taken, such as immediate arrest solely because a loan was not paid.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name or personal information outside permitted disclosures.
Communicating false loan information, including failing to disclose that a debt is disputed when communicating information that should be known to be false or incomplete.
Impersonating a court, police officer, government employee, lawyer, or another person, or using other deceptive collection methods.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions when the account has been past due for more than 15 days or the borrower expressly agreed, through written, electronic, or recorded means, that those are the only reasonable times for contact.
Contacting people found in the borrower’s contact list who are not legally involved in the obligation.

Even where the collection-hour exception applies, threats, deception, public shaming, unlawful disclosure, and other abusive conduct remain prohibited.

The lender cannot avoid responsibility simply by blaming a collection agency. SEC rules place ultimate responsibility for outsourced collection on the financing or lending company. The Financial Products and Services Consumer Protection Act also makes a financial service provider responsible for its agents and solidarily liable with accredited third-party service providers for covered acts or omissions, including debt collection.

Privacy rules for contact lists, photos, and app permissions

The Data Privacy Act of 2012, NPC Circular No. 20-01, and its 2022 amendment require loan providers to process personal data lawfully, transparently, proportionately, and only for legitimate purposes.

The rules apply to lending and financing companies, third-party processors, and persons acting as lenders—even if the entity lacks the required SEC authority.

Contact lists

An app may obtain only limited access needed to let you select a character reference or guarantor, or to derive proportionate metadata for a specified legitimate purpose. Unconstrained or excessive harvesting, copying, saving, or using contact-list data is prohibited.

For debt collection, the lender may contact only a person who is genuinely a guarantor. A guarantor must separately and expressly consent to undertake the borrower’s obligation in case of default. Merely appearing in a phone book, being a relative, receiving a reference call, or being named as a character reference does not make someone a guarantor.

A character reference may be contacted to verify the borrower’s identity or the truth of information supplied in the application. The reference may not be used for debt collection, marketing, cross-selling, or unrelated disclosures, and must be offered a way to request removal of their data.

Photos, camera, and storage

Camera or gallery access may be requested for a legitimate purpose such as identity verification, fraud prevention, or payment verification. Access should stop, or the borrower should be prompted to revoke it, once that purpose has been completed. A borrower’s photo must never be edited, posted, circulated, or otherwise used to harass or embarrass the borrower.

Consent is not a blanket defense

Pressing “Allow” does not authorize public shaming or unlimited processing. Consent must relate to a specific, explained purpose. The DICT-NPC-SEC Joint Advisory dated 18 March 2026 warns that pre-ticked boxes, hidden privacy-protective choices, and interfaces that make consent easy but withdrawal difficult may undermine data-privacy principles and may invalidate consent.

Personal data should be kept only as long as necessary for the original purpose, a legal obligation, or the establishment, exercise, or defense of legal claims. Deletion is therefore not absolute, but indefinite retention for an unspecified future use is not permitted.

What to do immediately

1. Protect yourself from urgent harm

If there is an immediate threat to your life, safety, home, or family, call 911 or contact the nearest police station. Do not meet a threatening collector alone.

For online threats, extortion, impersonation, fraud, or account compromise, the March 2026 joint advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

A regulator’s administrative complaint is not a substitute for urgent police assistance.

2. Preserve evidence before blocking, deleting, or uninstalling

Save the evidence in at least two secure places. Preserve:

Complete screenshots of texts, chats, emails, social-media posts, and app notifications, including the sender, number or account, date, and time.
URLs, usernames, profile pages, group names, and the names of people who received the messages.
Original emails with headers and original message or media files when possible.
Call logs, voicemails sent to you, and contemporaneous written notes stating what was said, by whom, and when.
The app’s name, icon, download page, developer name, package identifier, website, privacy notice, consent screens, and requested permissions.
The lender’s corporate name, collection agency, collector’s name, phone numbers, email addresses, office address, and SEC registration or certificate-of-authority details, if available.
The loan agreement, disclosure statement, promissory note, repayment schedule, statement of account, proof of disbursement, receipts, and payment confirmations.
Copies of your written objections and the company’s replies.
Statements or screenshots from relatives, co-workers, employers, or friends who were contacted.

Ask affected contacts to preserve the original messages instead of forwarding only cropped screenshots.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Call logs, saved voicemails, written messages, and detailed notes can be preserved without creating that separate risk.

3. Secure your device

After documenting the permissions and relevant screens:

Revoke the app’s access to contacts, photos, camera, microphone, location, storage, and other unnecessary resources.
Change passwords for your email, app-store, social-media, and financial accounts if compromise is suspected.
Enable multi-factor authentication and review logged-in devices.
Do not give a collector your OTP, PIN, password, card details, or account credentials.
Do not install a replacement app, remote-access tool, or APK sent by the collector.
Verify any payment instruction through the lender’s official website or customer-service channel. Avoid paying an individual collector’s personal account without verified authority and an official receipt.
Preserve the necessary evidence before uninstalling the app or resetting the phone.

4. Send the lender a written complaint

Use the lender’s official consumer-assistance or data-protection channel. Identify the account without unnecessarily attaching complete identity documents.

State:

The app and legal company names.
The dates, numbers, accounts, and collectors involved.
The exact conduct complained of.
Which contacts, photos, or other data were accessed or disclosed.
Whether the amount or debt is disputed.
The action requested—for example, stop contacting non-guarantors, stop publication, correct the account, identify the collector, restrict unnecessary processing, preserve relevant records, and provide a written response.
That future communications should use a specified lawful channel.

Keep proof that the company received the complaint. This is especially important for an NPC case because the ordinary rule requires giving the respondent an opportunity to act first.

Where and how to report

SEC: unfair collection by lending or financing companies

Submit the complaint through the SEC I-Message Mo portal. The March 2026 joint advisory also lists the SEC hotline 1-4732 (1-4SEC).

Include the lender’s legal name as well as the app’s brand name. Attach a clear chronology, evidence, loan documents, proof of your written complaint, and the identities or numbers used by collectors. If several companies are involved, separate the allegations and evidence for each respondent. The SEC’s published complaint guidance requires complete information, supporting evidence, and valid identification and warns that an insufficient complaint may be dismissed.

The SEC handles unfair collection and regulatory violations involving financing and lending companies. A complaint may lead to investigation or administrative action, but filing alone does not cancel the debt or automatically stop a civil collection case.

NPC: misuse or disclosure of personal data

Before filing an ordinary formal complaint, notify the lender, collection agency, or other responsible personal-information controller in writing. Under the 2021 NPC Rules of Procedure, you may ordinarily proceed when:

The respondent failed to take timely or appropriate action; or
No response was received within 15 calendar days after the respondent received your written notice.

The NPC may waive this requirement for properly alleged and proven good cause or a serious violation—for example, grave and irreparable harm requiring NPC action, no adequate remedy from the respondent, or conduct that is patently illegal. Explain and document why a waiver is needed; it is not automatic.

Use the NPC’s Complaints-Assisted Form. The formal complaint must generally:

Be written, signed, verified, and sworn.
Identify the complainant and respondent, or state facts that can help identify an unknown respondent.
Describe the personal data processed and the material facts.
Attach documentary evidence and relevant witness affidavits, if available.
Attach correspondence with the respondent and describe its response.
State the relief requested.
Include a sworn certification against forum shopping.
Include a special power of attorney if filed through a representative.

If you later learn that a case involving the same or similar issues has been filed elsewhere, the certification requires reporting that fact to the NPC within five calendar days.

The rules allow filing at any NPC office by personal submission, registered mail, courier, or authorized email. Confirm the current instructions through the NPC complaint page or NPC contact directory. The current listed office is at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City, with trunkline (02) 5322-1322.

The NPC’s service-fee form dated 7 May 2025 lists a ₱500 complaint filing fee, plus a legal-research fee and, when damages are claimed, an additional fee:

Claim not exceeding ₱20,000: ₱150
More than ₱20,000 up to ₱100,000: ₱500
Every succeeding ₱100,000, or fraction thereof: ₱500

Government complainants and qualified indigent complainants are exempt under the procedural rules. The NPC may also waive the fee on motion for good cause. Obtain a current assessment before paying and use only an official NPC payment channel.

BSP: when the lender is BSP-supervised

If the credit product is provided by a bank, digital bank, e-wallet operator, or another BSP-supervised institution, complain first through the institution’s Financial Consumer Protection Assistance Mechanism.

If its response is unsatisfactory, escalate through the BSP Online Buddy on the BSP website or official Facebook page. If BOB is inaccessible, the BSP’s current complaint guide permits submission of the prescribed complaint form by email with proof that the institution’s complaint process was used first.

Ordinary financing companies, lending companies, their online lending platforms, and their collection agencies are generally under the SEC—not the BSP. Privacy issues may still be reported separately to the NPC.

What to put in a strong report

Organize the complaint so an investigator can understand it without guessing:

Who: App name, lender’s legal name, collection agency, collector, and all relevant numbers or accounts.
What: Exact words, posts, disclosures, threats, or permissions used.
When: A chronological list with dates and times.
Whose data: Identify whether the affected person was the borrower, character reference, guarantor, relative, co-worker, or another contact.
Why improper: Explain, for example, that the person contacted was not a guarantor, the photo was used for shaming, or the collector disclosed the debt to an employer.
Evidence: Number the attachments and refer to those numbers in the narrative.
Prior notice: Attach the complaint sent to the company, delivery proof, and response.
Requested relief: Be specific about stopping disclosure, correcting records, restricting processing, identifying collectors, or investigating regulatory violations.

Use accurate language. Separate what you personally witnessed from what another person told you, and obtain that person’s statement or original screenshots when possible.

Important deadlines and legal limits

Act promptly even when no short filing deadline appears to apply.

For claims accruing specifically under the Financial Products and Services Consumer Protection Act, the statute generally provides a five-year period from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, with an outside limit of 10 years from the violation. Other administrative, civil, privacy, and criminal remedies may have different prescriptive periods.

The NPC’s 15-calendar-day period is an exhaustion requirement—not a reason to wait where serious or irreparable harm requires immediate assistance. Report active threats to law enforcement immediately and explain any request for an NPC waiver.

Harassment does not decide whether the debt is valid

A collector’s misconduct does not automatically extinguish the principal, lawful interest, or other valid charges. Likewise, owing money does not authorize harassment.

The Constitution provides that no person may be imprisoned for debt. A lender may pursue a lawful civil claim, and a genuine court summons should never be ignored. Separate criminal allegations, such as fraud supported by their own legal elements and evidence, are different from mere failure to pay. A collector cannot personally order your arrest or guarantee that you will be imprisoned.

If the amount is wrong:

Dispute it in writing.
Ask for an itemized statement of account and copies of the governing disclosures and contract.
Identify payments that were omitted or misapplied.
Keep paying only amounts you accept as due through verified channels, if appropriate to your circumstances.
Seek legal advice before signing a restructuring agreement, waiver, admission, or settlement you do not understand.

Common mistakes to avoid

Deleting the app, chats, or posts before preserving complete evidence.
Submitting cropped screenshots that omit the sender, date, or context.
Naming only the app brand and not the company behind it.
Filing an NPC complaint without first sending written notice or explaining why that requirement should be waived.
Treating a character reference as though the person agreed to guarantee the loan.
Secretly recording calls without considering the Anti-Wiretapping Act.
Sending complete IDs, account credentials, OTPs, or unnecessary sensitive data to unverified addresses.
Paying a collector’s personal e-wallet without verifying authority and obtaining a receipt.
Assuming that an SEC or NPC complaint automatically suspends payment or cancels the contract.
Ignoring a genuine court document because collectors previously sent fake legal threats.
Posting the collector’s personal data publicly in retaliation, which may create additional privacy or defamation issues.

When legal help is urgent

Consult a lawyer or the Public Attorney’s Office promptly when:

A threat appears credible or identifies your home, children, workplace, or daily routine.
Intimate images, altered photos, government IDs, medical information, or financial credentials were exposed.
Money is being demanded through extortion or an impersonated government process.
Your identity or accounts may have been taken over.
You receive a subpoena, summons, prosecutor’s notice, or court pleading.
You are seeking damages, an urgent order to stop processing, or action against several related companies.
The lender disputes the authenticity of messages or the identity of its collector.
You may be close to a prescriptive deadline.

Frequently asked questions

Can an online lending app contact my family, employer, or friends?

Not merely because their details appear in your phone. For debt collection, the current NPC rules allow contact with an actual guarantor who separately consented to that obligation. A character reference may be contacted only for identity or information verification—not to pressure that person into paying or shaming the borrower.

I allowed contact access when I installed the app. Does that make the messages legal?

No. Permission does not authorize unlimited harvesting, disclosure, harassment, or public shaming. Processing must remain lawful, necessary, proportionate, and connected to an explained purpose.

May the collector post my name, photo, ID, or loan balance online?

Public shaming and using a borrower’s photo to harass or embarrass them are prohibited. Narrow disclosures may be lawful when authorized by law, a court order, or a legitimate and properly controlled collection or credit process, but those exceptions do not permit public humiliation.

Can I report an unregistered or unidentified app?

Yes. Report the available details to the SEC, including the app-store page, developer, website, payment accounts, phone numbers, privacy notice, and loan documents. NPC loan-processing rules also cover persons acting as lenders whether or not they hold the required SEC authority.

Should I block the collector?

Preserve the evidence first. You may then block or mute abusive accounts where needed for safety. Keep at least one secure written channel open if you still need account statements, dispute resolution, or proof of further conduct.

Can I demand deletion of all my information after payment?

You may request deletion or blocking where the legal conditions are met. The lender may retain limited information when required by law or reasonably necessary for a legal claim, accounting, or another lawful purpose. It should not retain or reuse data indefinitely for an unspecified purpose.

Do I need a lawyer to complain?

A lawyer is not ordinarily required for an initial SEC report or for contacting the lender. An NPC formal complaint is verified, sworn, and subject to procedural requirements, so legal help can be valuable—especially where damages, emergency relief, several respondents, or parallel court proceedings are involved.

Will filing a complaint stop collection?

Not automatically. It can challenge unlawful methods and trigger regulatory action, but reasonable and lawful collection may continue unless an authority issues an appropriate order or the parties reach an agreement.

Official sources

This article provides general Philippine legal information, not advice for a particular case. Procedures and appropriate remedies depend on the lender’s identity, the contract, the data processed, and the evidence. Official sources and filing information were checked on 11 August 2026.