Quick answer

If an online lending app harasses you, publicly shames you, threatens unlawful harm, or uses your contacts, photos, or other personal data improperly:

Preserve the evidence before blocking numbers or deleting the app.
Revoke unnecessary app permissions and secure your accounts.
Send a written complaint to the lender or its data protection officer.
Report unfair collection practices to the Securities and Exchange Commission (SEC).
File a privacy complaint with the National Privacy Commission (NPC) if the company fails to act within 15 calendar days—or ask the NPC to waive that waiting requirement when the violation is serious or urgent.
Contact law enforcement immediately for credible threats, extortion, fraud, stalking, account takeover, or danger to a person or property.

Harassment and privacy violations do not automatically erase a valid loan. The debt dispute and the collector’s unlawful conduct are separate issues.

What lenders and collection agents are not allowed to do

Lending and financing companies must treat borrowers fairly and respectfully. The Financial Products and Services Consumer Protection Act prohibits abusive collection or debt-recovery practices and makes financial service providers responsible for relevant acts of their employees, agents, and accredited third-party service providers.

The SEC’s rules on unfair debt-collection practices and the government’s March 2026 advisory on online lending platforms prohibit or condemn conduct such as:

Threatening violence or other criminal means to harm a person, reputation, or property.
Threatening action that cannot legally be taken.
Harassment, intimidation, insults, or public shaming.
Posting or circulating a borrower’s name, photograph, loan information, fabricated notices, or humiliating material to pressure payment.
Using personal data in an unfair collection campaign.
Contacting people from the borrower’s contact list for debt collection when they are not guarantors.
Using collection agencies or individual collectors as a way to avoid the lender’s legal responsibilities.

A collector may communicate a legitimate demand for payment and may pursue lawful remedies. A genuine notice, demand letter, or court process is different from a fabricated threat of immediate arrest, public exposure, or violence. Whether a particular message amounts to a criminal offense depends on its exact language, context, sender, and supporting evidence.

When access to your contacts or photos becomes a privacy violation

Under the Data Privacy Act of 2012, personal information must be processed transparently, for a legitimate purpose, and only to a proportionate extent.

The detailed rules appear in NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02. They apply to lending and financing companies, entities acting as lenders, and their service providers—including entities operating without the required SEC authority.

An online lending app may not demand or use unnecessary permissions. Limited processing may be lawful when genuinely necessary and proportionate—for example:

Temporary camera or photo-gallery access for identity verification, fraud prevention, or payment verification.
Limited access allowing the borrower to select a character reference or guarantor.
Deriving proportionate contact-list metadata for a specified and legitimate purpose.

That does not authorize unrestricted copying, saving, messaging, or exploitation of the entire contact list. Once a permission is no longer needed and no other lawful basis applies, the app should turn it off or tell the user it may be revoked.

Character reference versus guarantor

These roles are legally different:

A character reference is provided only to help verify the borrower’s identity or the truthfulness of information in the loan application. The lender must explain how the reference’s details were obtained and allow removal of those details. A character reference cannot automatically be treated as responsible for the debt.
A guarantor expressly agrees to answer for the borrower’s obligation if the borrower defaults. The lender must obtain the guarantor’s separate consent in accordance with applicable law.

For debt collection, the lender may contact a properly consenting guarantor. It may not use the borrower’s contact list to pursue relatives, friends, co-workers, clients, or character references who are not guarantors.

Preserve evidence before taking other action

Electronic evidence may need to be authenticated later. The Supreme Court Rules on Electronic Evidence make the integrity, source, and reliability of electronic records important.

Save the following where available:

Full screenshots and screen recordings showing the message, sender, date, time, account name, telephone number, and surrounding conversation.
Original SMS, chat exports, emails, voice messages, call logs, and recordings lawfully obtained.
The app’s store listing, developer name, download link, app version, privacy notice, consent screens, and requested permissions.
Screenshots of the permissions actually enabled on your device.
Public posts, group messages, altered photographs, fake legal notices, or messages sent to your contacts.
Statements or screenshots from people who received collection messages. Ask them not to delete the originals.
The loan agreement, disclosure statement, repayment schedule, amount actually received, fees, collection notices, payment receipts, and account ledger.
The lender’s corporate name, app name, SEC registration or Certificate of Authority details, office address, email addresses, payment accounts, and collector identities.
Your written complaint to the company and proof of delivery or receipt.
A dated chronology identifying what happened, who was involved, and how it affected you.

Keep uncropped originals as well as working copies. Back them up in a secure location. Do not edit message files, alter timestamps, impersonate the collector, or provoke additional threats merely to obtain evidence.

Protect yourself and your data

After preserving evidence:

Revoke the app’s access to contacts, photos, camera, microphone, location, storage, SMS, and call logs unless a permission remains genuinely necessary.
Change passwords for email, social media, cloud storage, banking, and e-wallet accounts if the app or collector may have obtained access.
Enable multi-factor authentication and review logged-in devices and account-recovery details.
Tell affected contacts that the messages came from a collector and ask them not to engage, pay, click links, or share your information.
Report abusive numbers or accounts to the messaging platform, social network, app store, or telecommunications provider after preserving the content.
Pay only through a verified official channel. Do not send money to an unfamiliar personal account merely because a threatening message demands it.
If the amount is disputed, request a written statement showing the principal, interest, fees, payments, and current balance.

Revoking a permission stops or limits future access; it does not necessarily delete information already copied. A separate written deletion, blocking, or objection request may therefore be necessary.

Send a written complaint to the company

Address the complaint to the lender’s consumer-assistance unit and data protection officer, if identified in the app, agreement, or privacy notice. Send it through a channel that provides proof of delivery.

Include:

Your name and loan or account reference, while avoiding unnecessary sensitive information.
The app’s name and the lender’s full corporate name.
A short, dated account of the conduct.
The telephone numbers, accounts, employees, or collection agency involved.
The personal data accessed, copied, disclosed, or used.
Copies of the strongest evidence.
A request to stop the harassment, preserve relevant records, investigate the collector, correct the account if necessary, identify the source and lawful basis for processing, and delete or block data that is no longer lawfully needed.
A request for a written response.

Do not send passwords, PINs, one-time passwords, card security codes, or complete bank credentials. Redact unrelated information from IDs and documents where appropriate, but keep unredacted originals securely.

Report unfair collection practices to the SEC

The SEC regulates non-bank lending companies, financing companies, their online lending platforms, and their collection agencies.

The government’s current advisory directs complaints about unfair debt collection to the SEC Financing and Lending Companies Department through the SEC i-Message Mo portal. The advisory also lists the SEC hotline 1-4732 (1-4SEC).

When filing:

Identify both the app and the legal company operating it.
Name the collection agency if known.
Describe each incident with dates and evidence.
Attach the loan documents, collection messages, payment records, and a valid government-issued ID as required.
Use a separate complaint for each respondent company if instructed by the SEC.
Keep the ticket or reference number and copies of everything submitted.

The SEC’s complaint guidance for lending and financing companies warns that incomplete complaints or complaints without evidence may be dismissed. The SEC may seek the company’s response and, when supported, commence administrative action.

The SEC does not automatically cancel a loan, rewrite its payment terms, or declare a contract or interest provision void merely because a complaint was filed. Those questions may require a separate adjudicatory proceeding, settlement, or court action.

You can also use Check with SEC to investigate the company’s disclosed identity and status. Report the app even if it appears unregistered; lack of registration does not make harassment or unlawful data processing acceptable.

File a privacy complaint with the NPC

Use the NPC process when the app or collector improperly accessed, retained, disclosed, or used your personal information—for example, by harvesting contacts, messaging non-guarantors, circulating your photograph, or publicizing loan information.

The 15-calendar-day requirement

Under the 2021 NPC Rules of Procedure, you generally must first:

Inform the company or other responsible entity of the privacy violation in writing; and
Show that it failed to take timely and appropriate action, or failed to respond within 15 calendar days after receiving your written notice.

The NPC may waive these requirements for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy from the respondent, or conduct that is patently illegal. Explain and prove why a waiver is necessary rather than simply omitting the prior written notice.

What a formal NPC complaint needs

A formal complaint should be:

In writing, signed, and verified.
Clear about the complainant and respondent.
Supported by a factual narrative and available evidence.
Accompanied by correspondence with the respondent and proof of compliance with the 15-day rule, or facts supporting a waiver.
Specific about the relief requested.
Accompanied by the required verification and certification against forum shopping.
Supported by affidavits where needed to identify or authenticate documents.

A representative generally needs a special power of attorney. If another proceeding involving the same issues has been filed, disclose it accurately in the certification against forum shopping. A later-discovered similar case must be reported to the NPC within five calendar days, as required by its rules.

The NPC provides a Complaints-Assisted Form, a complaint information page, and current contact and office details. The rules permit filing at an NPC office and recognize personal filing, registered mail, courier, and electronic filing when authorized by the Commission. Confirm the current submission instructions before sending documents.

NPC filing fees

The NPC’s published schedule lists a ₱500 filing fee, plus a legal research fee equal to 1% of the filing fee but not less than ₱10. Additional fees may apply when damages or special relief are requested. The NPC’s current service-request form reflects these charges.

Qualified indigent litigants may seek exemption by submitting the required proof. Under the published fee rules, the applicant and immediate family must have gross income not exceeding twice the applicable monthly minimum wage and must not own real property with a fair market value above ₱300,000. Required supporting documents include a barangay certificate of indigency and specified affidavits and property documents.

When the BSP is the proper financial regulator

If the loan is provided by a bank, digital bank, e-wallet provider, or another institution supervised by the Bangko Sentral ng Pilipinas, first complain through that institution’s Financial Consumer Protection Assistance Mechanism.

If its response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism. The BSP’s current complaint guide directs consumers to the BSP Online Buddy chatbot or, when BOB is unavailable, the prescribed complaint form and email channel with proof of the first-level complaint.

Complaints involving ordinary SEC-regulated online lending or financing platforms are generally better directed to the SEC. Privacy issues may still be brought to the NPC regardless of which financial regulator supervises the provider.

When to contact law enforcement immediately

Do not wait for the lender’s response if there is:

A credible threat of physical harm, kidnapping, property damage, or violence.
Extortion or a demand backed by threats to expose private material.
Stalking, an attempt to enter your home or workplace, or an unsafe in-person confrontation.
Account takeover, identity theft, fraudulent transactions, or use of falsified documents.
Distribution or threatened distribution of intimate images.
Threats involving a child or another vulnerable person.

For immediate danger, call 911, the Philippines’ unified emergency number, or go to the nearest police station. The March 2026 government advisory also identifies the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group as reporting channels for harassment, threats, fraud, and scams. Their current contact details are listed in the official online-lending advisory.

A regulator’s administrative complaint does not replace a police or prosecutorial complaint when the conduct may be criminal.

Common mistakes to avoid

Deleting the app or conversation before preserving evidence.
Submitting cropped screenshots that hide the sender, date, or context.
Naming only the app and not attempting to identify the operating company.
Blocking every number before saving messages, voicemails, and call logs.
Sending a complaint without the loan documents or a clear timeline.
Assuming that every request for payment is harassment.
Assuming that harassment automatically cancels the principal debt.
Treating a character reference as a guarantor—or allowing a collector to do so.
Paying through an unverified personal account under pressure.
Posting your ID, loan agreement, or private messages publicly while seeking help.
Filing multiple cases involving the same issues without disclosing them where a certification against forum shopping requires disclosure.
Waiting until evidence, accounts, posts, or app listings have disappeared.

Frequently asked questions

Can the lender contact everyone in my phone?

No. Limited, proportionate contact-list processing may be allowed for specified legitimate purposes, such as letting you select a reference or guarantor or deriving proportionate metadata. Unrestricted harvesting and using the list to collect from or shame other people is prohibited. For debt collection, the lender may contact only a properly consenting guarantor—not ordinary contacts or a character reference who never agreed to guarantee the loan.

Can a character reference be forced to pay?

Not merely because the person was listed as a reference. A guarantor must expressly consent to undertake the obligation. The actual documents and circumstances should be reviewed if the lender claims that a person signed or electronically accepted a guaranty.

Should I uninstall the app immediately?

Preserve the app listing, permissions, privacy notice, loan records, and abusive messages first. Then revoke unnecessary permissions. You may uninstall the app after securing the evidence and ensuring that you still have an official way to obtain statements and make any lawful payment.

Can someone who is not the borrower complain to the NPC?

Potentially, yes. A family member, friend, co-worker, or reference whose own personal data was improperly obtained or used is a data subject and may file a complaint about that processing. The person should ordinarily send the responsible entity a written notice first and follow the NPC’s 15-calendar-day rule unless grounds for waiver exist.

What if the collector is a third-party agency?

Identify both the collector and the lender. Outsourcing does not remove the lender’s accountability for personal data under its control, and financial-service providers may be responsible for relevant acts of their collection agents or accredited service providers.

What if I already paid the loan?

Preserve receipts and request a written zero-balance or settlement confirmation. Continued collection, disclosure, or retention after settlement may strengthen a complaint, depending on the records and whether the company still has a lawful basis to retain particular information.

Does filing a complaint stop collection automatically?

No. Unless the regulator or a court issues an applicable order, lawful collection may continue. The company must nevertheless stop harassment, unlawful disclosure, and other prohibited conduct.

Is consent in the app enough to legalize access to everything?

No. Consent must be informed and tied to a specific purpose. Processing must remain lawful, necessary, and proportionate. Deceptive interfaces, unnecessarily broad permissions, or use of data for harassment are not cured merely by a general “I agree” button.

Disclaimer

This article provides general Philippine legal information, not advice for a particular case. The proper regulator, remedy, filing requirements, and possible liability depend on the lender’s identity, the loan documents, the messages sent, and how personal data was processed. Seek a Philippine lawyer promptly when there are significant financial claims, pending proceedings, serious threats, or possible criminal conduct.

Primary sources and official procedures checked as of August 11, 2026.