Quick answer

Online lenders may demand payment through lawful and reasonable collection methods, but they may not threaten, shame, deceive, publicly expose, or misuse personal data to pressure a borrower. They may not harvest a borrower’s phone or social-media contacts for debt collection, nor use the borrower’s photograph to humiliate the borrower.

If this happens:

Preserve the messages, call records, app details, loan documents, and proof of disclosure.
Send the lender or its data protection officer a written demand to stop the harassment and unlawful processing.
Report unfair collection practices to the Securities and Exchange Commission (SEC).
File a formal privacy complaint with the National Privacy Commission (NPC) after the required written notice to the lender, unless circumstances justify waiver of that requirement.
Report threats, extortion, impersonation, stalking, or other possible crimes promptly to the police or the National Bureau of Investigation (NBI).

Reporting misconduct does not automatically cancel a valid loan. The borrower should separately request a complete statement of account, dispute unauthorized or incorrect charges in writing, and pay only through a verified official channel.

What collection practices are prohibited?

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing and lending companies, their employees, and third-party collection agents from using unfair debt-collection practices.

Depending on the actual words, conduct, audience, and circumstances, prohibited collection conduct may include:

using or threatening violence or other criminal means;
threatening actions that cannot legally be taken;
using obscenities, insults, or profane language;
publicly disclosing or publishing the borrower’s personal information to shame the borrower;
communicating or threatening to communicate false credit information;
using false representations or deceptive means to collect;
falsely claiming to represent a court, law-enforcement agency, government office, or lawyer;
contacting people in the borrower’s phone directory who are not guarantors or co-makers;
revealing the debt to relatives, friends, co-workers, employers, or other third parties without a lawful and necessary basis; and
repeatedly contacting the borrower at unreasonable or inconvenient times in a manner amounting to harassment.

A legitimate demand letter, reminder, or notice of legal action is not automatically harassment. A lender may state the amount allegedly due, request payment, contact a properly identified guarantor or co-maker, and pursue remedies actually available under the contract and the law. The manner of collection, however, must remain truthful, proportionate, and lawful.

The lender generally remains accountable for collectors and service providers acting for it. It cannot necessarily avoid responsibility by saying that an outside collection agency sent the messages.

When does collection become a privacy violation?

The Data Privacy Act of 2012 requires personal information to be processed fairly, lawfully, transparently, and only for legitimate and proportionate purposes. A lender’s need to evaluate or collect a loan does not give it unlimited authority over a borrower’s contacts, photographs, messages, device files, or social-media connections.

Under NPC Circular No. 2020-01:

a lending app must not require permissions involving personal or sensitive personal information unless they are suitable, necessary, and not excessive for a legitimate loan-processing purpose;
access to a camera or photo gallery for identity verification does not authorize later use of the borrower’s photograph for harassment or embarrassment;
access to phone contacts, email lists, or social-media contacts—and copying or saving those contacts for collection or harassment—is prohibited;
an app should instead provide a separate interface through which the borrower voluntarily supplies chosen character references or co-makers;
personal data must not be retained indefinitely without a legitimate, declared purpose; and
lenders remain accountable for personal data processed by outsourced collectors or service providers.

Possible privacy violations therefore include:

uploading a “scammer” or “wanted” poster using the borrower’s photograph;
texting everyone in the borrower’s contact list;
telling unrelated persons that the borrower has an unpaid loan;
accessing contacts or photographs beyond what was necessary for identity verification;
using a character reference’s information for unrelated purposes;
sending loan advertisements to contacts whose information was harvested from the borrower’s phone;
continuing to use data after the legitimate purpose has ended without another lawful basis; or
refusing to explain how the lender obtained or used the person’s information.

Consent is not a blanket defense. Even when the borrower tapped “Allow” during installation, the collection and use of personal data must still be lawful, necessary, transparent, and proportionate.

What to do immediately

1. Preserve the evidence before blocking or uninstalling

Take screenshots or screen recordings showing:

the complete message, post, email, or chat;
the sender’s phone number, account name, profile link, or email address;
the date and time;
the app’s name and download page;
the name of the lending company stated in the loan agreement or disclosure statement;
the collector’s claimed name, company, and position;
threats, insults, altered photographs, public posts, or false accusations;
messages sent to relatives, friends, co-workers, or employers; and
app permissions for contacts, camera, files, location, microphone, or other device functions.

Ask recipients to preserve the original messages on their own devices. Obtain screenshots showing the sender and timestamp, not merely copied text.

Also save:

the loan application and contract;
promissory note and disclosure statement;
proof of the amount actually released;
repayment schedule;
receipts and transaction histories;
statement of account;
privacy notice and terms displayed when the loan was taken;
proof that the lender received your written complaint; and
any response from the lender or collection agency.

Do not edit screenshots in a way that hides context. Keep the original digital files and make backups.

2. Secure the phone and online accounts

After preserving evidence:

revoke unnecessary app permissions;
change passwords for affected email, social-media, and financial accounts;
enable multi-factor authentication;
check whether the app was installed from an unofficial file or link;
remove suspicious device-administrator or accessibility permissions; and
uninstall the app if it is no longer needed and doing so will not destroy evidence.

Revoking permission or uninstalling the app does not erase a valid debt. It limits further access to the device.

3. Identify the company behind the app

An app name may differ from the registered corporate lender. Check the loan agreement, disclosure statement, privacy notice, payment instructions, app-store developer information, and messages for the company’s legal name.

Verify whether the company has SEC authority to operate as a lending or financing company and whether its online lending platform is properly recorded. Save the result of the verification. If the company’s identity is concealed or appears false, say so in the complaint and attach the information available to you.

Do not send payment to a collector’s personal bank or e-wallet account merely because the person is threatening you. Confirm the payment channel directly with the company through independently verified contact information.

4. Send a written cease-and-desist and privacy complaint

Write to the company and, if identified, its data protection officer. State:

your name and loan or account reference;
the dates and nature of the harassment;
the numbers or accounts used by the collectors;
the personal data accessed or disclosed;
the identities of third parties contacted;
the action you demand; and
a reasonable request for written confirmation.

You may demand that the company:

stop contacting unrelated third parties;
stop publishing or disclosing your loan information;
remove unlawful posts;
preserve relevant records, including collector instructions and access logs;
identify the company and collection agency involved;
explain the source, purpose, recipients, and legal basis for processing your data;
provide access to personal data held about you, subject to lawful limitations;
correct inaccurate information;
securely delete unlawfully harvested contacts; and
provide a complete statement of account and an official payment channel.

Send the notice through an address identified in the contract, privacy notice, official website, or SEC record. Keep proof of delivery.

How to complain to the SEC

The SEC handles complaints involving lending and financing companies, including alleged violations of the Lending Company Regulation Act, Financing Company Act, Truth in Lending Act, and SEC rules on unfair debt collection.

Follow the SEC’s current complaint instructions for lending and financing companies:

Download and complete the SEC complaint form.
Prepare one complaint form for each respondent company.
Attach a copy of a valid government-issued ID.
Attach all relevant evidence, including messages, screenshots, disclosure statements, promissory notes, repayment schedules, receipts, and correspondence.
File through the channel currently listed on the SEC complaint page.

For email filing, follow the SEC’s stated subject-line format:

COMPLETE NAME_RESPONDENT COMPANY_SUBJECT OF COMPLAINT

The SEC may provide the respondent with a copy of the complaint for an answer or comment. Its published procedure states that the company is ordinarily given 10 days from receipt to respond. If sufficient grounds exist, the SEC may commence an administrative action.

The SEC cannot, merely through this complaint process, rewrite the parties’ contract, cancel the debt, declare the contract void, or decide that interest is invalid for being excessive. Those issues may require a separate defense, negotiation, or court action.

How to file a privacy complaint with the NPC

First notify the lender in writing

Under the 2021 NPC Rules of Procedure, a formal complaint generally will not be given due course unless the complainant shows that:

the lender, collection agency, or other concerned entity was informed in writing of the privacy violation or personal-data breach; and
it failed to take timely or appropriate action, or failed to respond within 15 calendar days after receiving the written notice.

The NPC may waive this exhaustion requirement for good cause or a serious violation—for example, where urgent NPC action is needed to prevent grave and irreparable harm, no adequate remedy is available from the respondent, or the conduct is patently illegal. A complainant requesting waiver should state and document the urgent circumstances.

Prepare the formal complaint

The complaint must generally be:

in writing;
signed and verified under oath;
supported by a factual narrative and evidence;
accompanied by correspondence showing prior written notice to the respondent;
clear about the relief requested; and
accompanied by a sworn certification against forum shopping.

If a representative files for the data subject, a special power of attorney is ordinarily required. The rules also provide for filing fees, subject to exemptions or waiver allowed under NPC rules.

The NPC’s current formal-complaint page provides the downloadable form and instructions. It directs complainants to print and complete the form, have it notarized, and submit it personally, by courier, or through the email address shown on that official page. Check the page immediately before filing because forms, fees, addresses, and electronic-filing instructions may change.

Consider an application for a temporary ban

Where harmful processing is ongoing—such as continuing mass disclosure, publication, or use of unlawfully obtained contacts—the complainant may consider applying for a temporary ban on processing. This is not automatically granted. The request must satisfy the NPC’s procedural and substantive requirements and should explain the urgent harm and the specific processing that must be stopped.

Use the NPC’s current temporary-ban instructions and form.

When to report the matter to law enforcement

Go promptly to the nearest police station, the PNP Anti-Cybercrime Group, or the NBI Cybercrime Division if the conduct includes:

a credible threat to kill or physically harm someone;
extortion or a demand for money backed by an unlawful threat;
impersonation of police officers, judges, lawyers, or government agencies;
account hacking or unauthorized access;
identity theft;
stalking or repeated conduct creating an immediate safety risk;
sexual threats or circulation of intimate images;
falsified warrants, summonses, or court documents; or
coordinated online publication that may constitute another criminal offense.

The precise offense depends on the words used, the intent, the manner of transmission, and the surrounding facts. Online conduct may implicate the Revised Penal Code, the Cybercrime Prevention Act, the Data Privacy Act, or other special laws. Not every rude or persistent message constitutes a crime, but an imminent threat should never be treated as merely a collection dispute.

The NBI publishes its service for investigative assistance to victims of computer crimes. Bring government identification, the device if safely available, original electronic evidence, printed copies, the loan records, and a concise chronology.

If anyone is in immediate danger, contact emergency services or the nearest police station without waiting for the lender’s 15-day response period. That waiting period relates to the ordinary NPC exhaustion rule; it does not prevent an urgent police report.

If you are only a contact person, friend, relative, or co-worker

You may have your own privacy complaint if your personal information was harvested or used without a lawful basis. You do not become responsible for the debt merely because your number appeared in the borrower’s phone, you were named as a character reference, or a collector contacted you.

A guarantor or co-maker may have contractual liability, but that depends on a valid agreement and its terms. A person who never agreed to guarantee or co-make the loan should not acknowledge liability or pay simply to stop the messages.

Tell the collector in writing that:

you are not the borrower;
you did not consent to assume the debt;
you require the source of your contact information;
you object to further unnecessary processing; and
you demand removal of your information where legally appropriate.

Preserve the response and include it in any NPC or law-enforcement complaint.

Dealing with the underlying loan

Harassment and privacy violations do not necessarily make the loan disappear. To prevent the collection issue from becoming more complicated:

Request a written statement showing the principal released, interest, fees, penalties, payments, and current balance.
Compare it with the disclosure statement and actual amount received.
Identify in writing every charge or payment you dispute.
Request restructuring or a payment arrangement if necessary.
Pay only through a verified company channel.
Keep receipts and obtain written confirmation when the account is fully paid.
Do not sign a settlement, acknowledgment, or waiver you do not understand.

Avoid giving new IDs, selfies, one-time passwords, passwords, or unnecessary personal information to an unknown collector.

Common mistakes to avoid

Deleting or blocking messages before preserving evidence.
Posting the borrower’s own IDs, loan documents, or phone number publicly while asking for help.
Complaining only through a social-media comment without sending formal written notice.
Naming only the app and failing to identify the corporation behind it.
Filing an NPC complaint immediately without addressing the 15-day prior-notice rule or explaining why it should be waived.
Submitting cropped screenshots that omit the sender, timestamp, or conversation context.
Sending one SEC complaint form against several different companies.
Assuming that an SEC or NPC complaint automatically suspends payment obligations.
Paying a personal account controlled by an unidentified collector.
Making a false claim that no loan exists when the real dispute concerns the amount, charges, or collection method.
Threatening collectors in return, which can create a separate dispute and weaken the complaint.

When legal help is urgent

Consult a lawyer promptly when:

the lender has circulated altered photographs, intimate material, or serious accusations;
threats involve physical harm, arrest, deportation, loss of employment, or harm to family members;
personal data has been disclosed to a large audience;
the app accessed extensive device data or accounts;
a summons, subpoena, warrant, or court pleading has actually been received;
the amount or identity of the creditor is disputed;
the lender is unregistered, concealed, or appears to be using several shell entities;
the victim suffered measurable financial, employment, medical, or reputational harm;
a temporary ban or other urgent order may be necessary; or
several borrowers or contacts appear to have been targeted through the same operation.

A lawyer can help distinguish administrative, civil, and criminal remedies and ensure that filing one proceeding does not create inconsistencies in another.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. NPC Circular No. 2020-01 expressly prohibits access to or harvesting of phone, email, or social-media contacts for debt collection or harassment. The borrower should be allowed to provide selected character references or co-makers through a separate interface.

Can the lender contact my employer?

Not every workplace communication is automatically unlawful, but disclosing the debt to supervisors or co-workers, humiliating the borrower, or using the workplace to exert improper pressure may violate SEC and privacy rules. The purpose, recipient, content, and necessity of the communication matter.

Can the collector post my photograph and label me a scammer?

Using a borrower’s photograph to harass or embarrass the borrower is expressly prohibited under NPC Circular No. 2020-01. A public accusation may also raise other civil or criminal issues depending on its content and circumstances.

Does giving the app permission to access contacts make the disclosure legal?

Not necessarily. Consent and permissions must be informed, specific, freely given where consent is relied upon, and consistent with lawful and proportionate processing. A device permission does not authorize contact harvesting or public shaming.

Must I wait 15 days before reporting threats to the police?

No. The 15-day period concerns the ordinary prerequisite for a formal NPC complaint. Credible threats, extortion, hacking, or immediate danger should be reported to law enforcement promptly.

Can I complain even if the loan is unpaid?

Yes. A delinquent borrower still has privacy rights and protection against unfair collection. The complaint does not, however, extinguish a valid unpaid obligation.

Can a character reference be forced to pay?

No, not merely because the person was listed as a reference. Liability as a guarantor or co-maker requires a legally sufficient undertaking; it is not created by being an ordinary contact or reference.

Will filing with the SEC erase my loan?

No. The SEC’s complaint process addresses regulatory violations. The SEC states that it cannot through that process cancel the obligation, rewrite payment terms, or declare the contract void.

Where should I report an unauthorized lender?

Include the available evidence in an SEC complaint and clearly state that the company’s authority or identity could not be verified. Privacy misconduct may separately be reported to the NPC, while threats, fraud, or other suspected crimes may be reported to law enforcement.

Official references

This article provides general legal information, not advice for a specific case. The proper remedy depends on the loan documents, communications, persons involved, and evidence. Official sources and procedures were checked as of August 25, 2026; verify the agencies’ current forms, fees, addresses, and filing instructions before submitting a complaint.