Quick answer

Online lending apps may collect a lawful debt, but they may not threaten, shame, deceive, or misuse personal data to force payment. Save the evidence, send the lender or its data protection officer a written complaint, then report:

abusive collection by an SEC-regulated lending or financing company to the SEC through iMessage;
unauthorized contact-list access, disclosure of the debt, doxxing, or other misuse of personal data to the National Privacy Commission;
a lender supervised by the Bangko Sentral ng Pilipinas first to the institution’s consumer-assistance channel, then—if unresolved—to the BSP Consumer Assistance Mechanism; and
threats of violence, extortion, impersonation, stalking, account intrusion, or similar potentially criminal conduct immediately to the police or the NBI.

These remedies may be pursued separately because harassment and privacy violations can fall under different agencies. Reporting misconduct does not automatically erase a valid loan, and paying or owing a debt does not legalize abusive collection.

What lenders and collectors are not allowed to do

Under SEC Memorandum Circular No. 18, Series of 2019, financing and lending companies—and the collectors they engage—may use reasonable and lawful collection methods. Prohibited practices include:

using or threatening violence or other criminal means against a person, reputation, or property;
threatening an action that cannot legally be taken;
using insults, obscene or profane language, or words amounting to abuse;
publishing or threatening to publish a borrower’s name or personal information to shame the borrower;
communicating false credit information or failing to disclose that a debt is disputed;
using false representations or deceptive means to collect or obtain information;
contacting people in the borrower’s phone contact list who were not named as guarantors; and
contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions for an account more than 15 days past due or contact made with the borrower’s consent through a written, electronic, or recorded medium.

A lender cannot avoid responsibility simply by outsourcing collection to an agency, law office, call center, or individual collector.

The broader Financial Products and Services Consumer Protection Act, Republic Act No. 11765, also prohibits financial service providers from employing abusive collection or debt-recovery practices. It protects financial consumers’ rights to fair treatment, data privacy, disclosure, and timely complaint handling.

Contact lists, character references, and guarantors are different

The current privacy rule is more precise than saying an app may “never access contacts.” Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

app permissions and personal-data processing must be suitable, necessary, and not excessive for a lawful purpose;
unrestricted or excessive processing of contact lists is prohibited;
a lender may have limited access that allows the borrower to select a character reference or guarantor, and may process proportionate contact-list metadata when the circular’s conditions are met;
contact-list processing that leads to harassment, unfair collection, or debt collection from people other than the borrower’s guarantors is prohibited;
a character reference is for verifying the borrower’s identity and the truth of information supplied during the application—not for collecting the debt;
a character reference does not automatically become a guarantor; and
a guarantor must have separately and expressly agreed to the guaranty. For debt collection, the lender may contact that guarantor, but not unrelated people appearing in the borrower’s contacts.

Using a borrower’s photograph to embarrass the borrower, messaging relatives or co-workers about the debt, or sending a text blast to unrelated contacts may therefore violate both SEC collection rules and data-privacy rules.

What to do immediately

1. Protect yourself first

If a collector makes a credible threat of physical harm, says someone is coming to your home, demands money through intimidation, or appears to know your real-time location, contact 911 or the nearest police station. Do not wait for an SEC or NPC case before addressing an immediate safety risk.

If you suspect that the app or collector obtained access to your email, social-media, bank, or e-wallet account:

change the affected passwords using a different, trusted device;
enable multi-factor authentication;
revoke unnecessary app permissions;
notify the bank or e-wallet through its official channel; and
never disclose an OTP, PIN, password, or complete card details to a collector.

Preserve the evidence before uninstalling the app, clearing its storage, blocking accounts, or changing the phone.

2. Preserve complete evidence

Keep originals and make at least one backup. Useful evidence includes:

screenshots showing the full message, sender, date, and time;
exported text, email, chat, and call logs;
voicemails already left on your device;
screenshots or screen recordings of the app’s name, developer, version, privacy notice, permissions, account page, and collection messages;
the app-store or website link;
the legal name of the lender shown in the loan agreement, disclosure statement, privacy notice, or payment instructions;
loan applications, promissory notes, disclosure statements, amortization schedules, receipts, and proof of payment;
notices sent to relatives, friends, co-workers, or employers;
screenshots and written statements from those recipients;
social-media posts, including the profile URL and post URL;
names, numbers, email addresses, and claimed affiliations of collectors;
proof of your written complaint to the lender and proof that it was received; and
a chronological incident log identifying what happened, when, through which account or number, and who witnessed it.

Do not submit only heavily cropped screenshots. Preserve the original files and surrounding conversation so their context can be checked.

Be cautious about secretly recording live calls. The Anti-Wiretapping Act, Republic Act No. 4200, generally prohibits secretly recording a private communication without authorization from all parties. The Supreme Court has applied this rule even when the person recording participated in the conversation. Preserve call logs, texts, voicemails, and written notes instead, or obtain legal advice before recording.

3. Identify the actual company

An app’s brand name may be different from the corporation operating it. Check:

the lender named in the loan contract and disclosure statement;
the app’s privacy notice and developer information;
the entity receiving payments;
SEC registration or certificate-of-authority details; and
any collection-agency or law-office name appearing in the messages.

Include both the app name and every known legal entity in your complaint. If the operator appears unregistered, say so and attach the facts supporting that conclusion. The NPC’s loan-data rules apply even to a person acting as a lender without the required SEC authority.

4. Send a written complaint to the lender

Write to the lender’s customer-assistance unit and data protection officer, if identified. State:

your name and account or loan reference;
the app and legal company name;
each offending act, with dates and collector details;
what personal data was accessed, used, or disclosed;
who received the disclosure;
why the conduct appears unauthorized or excessive;
the action you want; and
that you require a written response.

You may request, as appropriate:

an immediate end to threats, shaming, and third-party contact;
communication only through a specified lawful channel;
identification of the lender and collector;
correction of false account information;
information about the personal data processed, its source, recipients, purpose, and retention period;
blocking, erasure, or removal of unlawfully obtained or unlawfully used data;
notice to third parties that received inaccurate or unauthorized disclosures; and
preservation of collection logs, recordings, access records, and relevant system data.

Erasure is not automatic. A lender may retain information that remains necessary for a lawful contract, legal claim, regulatory obligation, or another valid ground. The Data Privacy Act and its implementing rules nevertheless give data subjects rights to information, access, correction, objection, erasure or blocking when justified, damages, and complaint.

Keep proof of delivery. For an NPC complaint, the general rule is that the lender must first have been informed in writing and allowed 15 calendar days from receipt to respond or take appropriate action.

How to report the lender to the SEC

For an online lending platform operated by a lending or financing company, use the SEC iMessage portal. The SEC’s current user guide identifies iMessage as its central platform for inquiries and complaints and lists “Complaints on Financing and Lending Companies” under the relevant monitoring and compliance service.

Prepare:

the completed SEC complaint information or form requested by the portal;
a valid government-issued ID;
the app name and respondent company’s complete legal name;
your loan documents and payment records;
the written complaint you sent to the company;
screenshots and other evidence; and
the specific relief or regulatory action requested.

Submit a separate complaint for each respondent company when directed by the SEC. The SEC’s financing-and-lending complaint guidance warns that incomplete complaints may be dismissed and states that the respondent ordinarily receives a copy and is given 10 days from receipt to answer or comment.

The SEC can evaluate possible violations, seek the company’s response, and commence an administrative proceeding when warranted. The SEC complaint process does not itself:

cancel or settle the loan;
rewrite the contract or payment schedule;
automatically declare an interest rate void; or
award every form of private monetary relief a borrower may seek.

If contract validity, repayment accounting, damages, or a court order is disputed, obtain advice from a Philippine lawyer or the Public Attorney’s Office, if eligible.

How to file a privacy complaint with the NPC

Use the NPC’s current formal-complaint page and Complaint-Affidavit form. The form may be used for unauthorized processing, processing for an unauthorized purpose, malicious or unauthorized disclosure, and related Data Privacy Act violations.

The 15-day prior-notice rule

Under the 2021 NPC Rules of Procedure, as amended, a complaint will generally not be given due course unless you show that:

you informed the lender, processor, or other respondent of the privacy violation in writing; and
it failed to take timely and appropriate action or did not respond within 15 calendar days after receiving your notice.

The NPC may waive this requirement for proven good cause or a serious violation, including circumstances involving grave and irreparable damage, lack of an adequate remedy from the respondent, or patently illegal action. Explain and document why immediate NPC intervention is needed rather than merely skipping the prior notice.

Form and attachments

The complaint should be:

written, signed, verified, and notarized;
filed by the affected data subject or a properly authorized representative;
supported by a clear chronological narration and evidence;
accompanied by the correspondence with the respondent;
specific about the relief requested; and
accompanied by a certification against forum shopping.

A representative generally needs a special power of attorney. The NPC form also requests a valid government-issued ID.

The NPC currently allows submission in person, by courier, or by scanned email to complaints@privacy.gov.ph. Its current Complaint-Affidavit lists the NPC at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103. Confirm filing and payment instructions on the NPC website before sending originals.

The current NPC schedule of fees lists a ₱500 complaint filing fee, a legal-research fee of 1% of the filing fee but not less than ₱10, and additional fees when damages are claimed. Qualified indigent complainants and certain government complainants may be exempt, subject to the required proof.

The NPC may, depending on the evidence and proceedings, order compliance, impose a temporary or permanent processing ban, impose administrative fines, award indemnity on matters affecting personal-data rights, or recommend prosecution to the Department of Justice. Criminal guilt and imprisonment can be imposed only through the proper criminal process—not simply because a complaint was filed.

If the lender is regulated by another agency

Banks and other BSP-supervised institutions

First file through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. If the response is unsatisfactory, escalate through the BSP Online Buddy on the BSP website or official Facebook page.

If BOB is inaccessible, the BSP’s current filing instructions allow use of its Complaint/Inquiry/Reply form sent to consumeraffairs@bsp.gov.ph, with proof that the concern was first raised with the institution.

A privacy complaint may still be filed separately with the NPC.

Cooperatives

For a cooperative offering the loan, first use the cooperative’s Financial Consumer Protection Assistance Management System. If unresolved, elevate the concern through the Cooperative Development Authority’s consumer-assistance mechanism. CDA guidance identifies this internal complaint as the first-level remedy under its financial-consumer rules.

Potential crimes

Report urgent or potentially criminal conduct separately. Options include:

the nearest police station or appropriate PNP cybercrime unit;
the NBI Online Complaint portal; or
the NBI Cybercrime Division.

Whether threats, defamatory posts, extortionate demands, impersonation, coercion, unauthorized account access, or other acts satisfy the elements of a criminal offense depends on the exact words, conduct, evidence, and surrounding circumstances. An SEC or NPC complaint does not replace a criminal report.

Common mistakes that weaken a complaint

Naming only the app. Identify the corporation, developer, collection agency, and collector whenever possible.
Deleting the app or messages too soon. Preserve complete evidence first.
Submitting cropped or undated screenshots. Retain sender details, timestamps, URLs, and surrounding messages.
Failing to notify the lender before filing with the NPC. Send written notice and preserve proof, unless you can establish a recognized ground for waiver.
Assuming every contact is illegal. A lender may contact the borrower and a genuinely consenting guarantor through lawful means. The legal issue is often who was contacted, why, what was disclosed, and how the information was obtained.
Treating a character reference as a guarantor. A reference does not become liable merely because the borrower supplied the person’s name.
Secretly recording a private call. Philippine anti-wiretapping law generally requires authorization from all parties.
Posting IDs, loan documents, or threats publicly. Redact sensitive information in public posts and submit unredacted evidence only through official or legally appropriate channels.
Paying an unverified personal account. Confirm payment instructions directly with the lender through an official channel and demand a receipt.
Believing the complaint cancels the debt. Challenge harassment and privacy violations while separately requesting an accurate statement of account or a lawful payment arrangement.

When legal help is urgent

Consult a lawyer promptly, or ask the Public Attorney’s Office about eligibility, when:

there is a credible threat to life, safety, home, work, or family;
intimate images, altered photographs, IDs, or sensitive records have been published or threatened;
the lender is contacting an employer, clients, or a large part of the borrower’s contact list;
accounts or devices may have been compromised;
a summons, subpoena, or court pleading has actually been received;
the lender disputes substantial payments or continues collecting a settled loan;
multiple companies or unknown foreign operators are involved;
significant damages are being claimed; or
a filing or reconsideration deadline in an agency or court case is already running.

Do not ignore a genuine court document. Verify it directly with the court named in the document rather than through the collector’s phone number.

Frequently asked questions

Can an online lender contact my family, friends, or employer?

Not merely because their details appear in your phone. Debt collection from people in the contact list other than expressly consenting guarantors is prohibited. A character reference may be contacted for the limited verification purpose allowed by NPC rules, but is not automatically a guarantor and should not be pressured to pay.

Can the lender post my name or photograph online?

Public shaming, publication of borrower information, and using a photograph to embarrass a borrower for collection may violate SEC and NPC rules. Preserve the post, profile, URL, date, audience, and comments before requesting removal.

I allowed contact access when installing the app. Does that make every use legal?

No. Consent does not automatically authorize unlimited processing. Processing must still be transparent, tied to a legitimate purpose, proportionate, and consistent with the specific notice and applicable law. Excessive contact harvesting, harassment, and debt collection from unrelated contacts remain prohibited.

Can I complain even if I really owe the money?

Yes. The existence of a debt does not excuse threats, deception, shaming, or unlawful personal-data use. The debt and the collector’s misconduct are separate issues.

Can the collector have me arrested for missing a payment?

A private collector cannot issue an arrest warrant. Threatening legal action that cannot lawfully be taken is an unfair collection practice. However, separate facts—such as alleged fraud or another independently defined offense—require individual legal assessment. Do not ignore authentic notices from a prosecutor or court.

Should I block the collector?

Preserve the evidence and send a written complaint first when safe. You may then block abusive numbers or accounts, but retain one controlled written channel if you want to receive an account statement, settlement proposal, or official notice.

Is there one deadline for all complaints?

No single deadline covers every SEC, NPC, civil, and criminal remedy. The NPC requires the 15-calendar-day prior-notice process in ordinary cases, but legal prescriptive periods vary by the violation and remedy. File promptly, especially when evidence may disappear or a formal agency or court deadline has begun.

Official legal sources

This article provides general legal information, not legal advice or a prediction of the outcome of any complaint. The proper remedy depends on the lender’s regulator, the loan documents, the words and acts used in collection, the personal data processed, and the available evidence. Official sources and procedures were checked as of 6 August 2026.