Quick answer

Report abusive collection practices by an ordinary online lending app to the Securities and Exchange Commission (SEC). Report unauthorized access, use, retention, or disclosure of your contacts, photos, messages, location, or other personal data to the National Privacy Commission (NPC). If there are credible threats, extortion, impersonation, hacking, stalking, or publication of intimate material, also report immediately to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or CICC. Call 911 if anyone is in immediate physical danger.

A valid unpaid loan does not authorize harassment or public shaming. Filing a complaint, however, does not automatically cancel the debt, suspend interest, or prevent lawful collection. Continue addressing any legitimate balance through verified official payment channels while separately disputing unlawful charges or collection conduct in writing.

Preserve the evidence before blocking numbers, revoking permissions, or uninstalling the app.

Conduct that may be reported

Under SEC Memorandum Circular No. 18, Series of 2019, financing and lending companies—and the collection agencies or other third parties they hire—must use reasonable, legally permissible collection methods and act in good faith. Prohibited practices include:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name or personal information for refusing or allegedly refusing to pay, unless a lawful disclosure exception applies.
Communicating false loan information, including failing to say that a debt is disputed when that fact should be disclosed.
Using false representations or deceptive methods to collect a debt or obtain information about the borrower.
Contacting a person before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed—through written, electronic, or recorded means—that those are the only reasonable times for contact.
Contacting people taken from the borrower’s phone contact list other than persons named as guarantors or co-makers.

Even where the exception for contact hours applies, threats, insults, deception, public shaming, and other prohibited conduct remain unlawful.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, separately requires fair and respectful treatment, prohibits abusive collection or debt-recovery practices, protects client data, and makes financial service providers responsible for their employees and agents. A provider may also be solidarily liable with an accredited third-party service provider involved in debt collection.

Privacy violations involving lending apps

The Data Privacy Act of 2012 requires personal-data processing to be transparent, lawful, proportionate, and limited to a legitimate purpose. Clicking “Allow” during installation does not give an app unlimited authority to copy, retain, publish, or use everything on a phone.

NPC Circular No. 2020-01, which specifically covers loan-related transactions, provides that:

An app must not require permissions that are unnecessary or excessive for identity verification, credit assessment, fraud prevention, or lawful collection.
Camera or gallery access may be permitted when necessary to obtain an identification photograph, but the permission should be turned off or the borrower prompted to disable it when the purpose has been completed.
A borrower’s photograph must never be used to harass or embarrass the borrower.
Accessing or copying phone contacts or email lists, harvesting social-media contacts, or saving those contacts for debt collection or harassment is prohibited.
The app should instead provide a separate interface in which the borrower chooses particular character references or co-makers.
Information must not be retained indefinitely merely because it might be useful someday.
The lender remains accountable for data handled by its collectors, contractors, and other service providers.

A person selected as a character reference is not automatically a guarantor, co-maker, or debtor. A chosen reference may be contacted for a proper reference-related purpose, subject to privacy rules, but should be told how the lender obtained the contact details. The lender should offer removal as a reference when feasible. Liability for the loan depends on the documents the person actually signed, not merely on being listed in an app.

Not every use or disclosure of borrower information is unlawful. A lender may process information reasonably necessary to administer and collect the loan and, subject to applicable law, may disclose appropriate information to authorized collection agencies, lawyers, service providers, credit-information entities, courts, or government authorities. Those exceptions do not permit disclosure to relatives, co-workers, employers, group chats, or social-media audiences simply to shame or pressure the borrower.

What to do immediately

1. Address urgent safety risks first

Call 911 if a message contains a credible threat of imminent violence or if a collector is outside your home or workplace.

For cyber-enabled threats, extortion, impersonation, account intrusion, or other suspected crimes, contact:

The PNP Anti-Cybercrime Group
The NBI online complaint service
The CICC Inter-Agency Response Center at 1326

The government identifies 1326 as a 24-hour reporting line for scams and cybercrime. Current PNP-ACG, NBI, and CICC contact details also appear in the BSP’s official consumer-complaint guide.

Do not meet a threatening collector alone. Tell a trusted person, building administrator, employer security office, or barangay or police authorities when necessary for safety.

2. Preserve evidence before changing the phone

Save both the content and its context:

Screenshots showing the complete message, sender’s number or account, date, time, and surrounding conversation.
Original emails, including headers where available.
Voicemails, call logs, missed-call history, and contemporaneous notes stating what was said during each call.
URLs, usernames, profile links, posts, group chats, altered photographs, and public comments.
Screenshots from relatives, friends, co-workers, or other people who received messages about the loan.
The app’s name, icon, app-store page, developer name, package identifier, website, privacy notice, and permission screen.
Screenshots of the phone’s permission history or privacy dashboard, if available.
The loan agreement, disclosure statement, promissory note, repayment schedule, account statement, disbursement record, and receipts.
Messages identifying the collector, collection agency, legal company name, and payment account.
A chronological incident log listing each number used, the words or conduct complained of, recipients, and resulting harm.
Copies of every complaint sent to the lender and proof of delivery or receipt.

Keep originals and make backed-up copies. Avoid editing or cropping the only copy.

Be cautious about secretly recording calls. In Ramirez v. Court of Appeals, the Supreme Court held that even a participant may violate the Anti-Wiretapping Act by secretly recording a private communication without the authorization of all parties. Preserve existing voicemails, texts, call logs, and detailed notes, or obtain legal advice before recording a private call.

3. Secure your accounts and device

After preserving the relevant screens:

Revoke unnecessary access to contacts, photos, camera, microphone, location, storage, and social-media accounts.
Change the passwords for the lending account, primary email, cloud storage, and any account that reused the same password.
Enable multi-factor authentication.
Review logged-in devices and remove sessions you do not recognize.
Warn affected contacts not to reply, click links, send money, or disclose information.
Report impersonating accounts and unlawful posts to the platform, while retaining evidence and the URL first.
Avoid factory-resetting or discarding the phone if a criminal investigation may require it.

Uninstalling the app may stop further device access, but it does not erase copies of data already taken. Preserve the app details and evidence before removal.

4. Write to the lender or its data protection officer

Use the legal company name shown in the contract, disclosure statement, privacy notice, or app-store listing. Send the complaint to the company’s customer-assistance unit and data protection officer, if identified.

A useful written complaint should include:

Your name and account or loan reference number.
The app’s name and the lender’s legal corporate name.
Dates, numbers, accounts, and names associated with the conduct.
The exact personal data accessed, used, or disclosed.
The identities of people who received the information.
Whether the debt or any part of the balance is disputed.
Copies of supporting evidence.
The specific action you want.

You may request that the company:

Stop threats, insults, public disclosure, contact-list messaging, and other prohibited practices.
Limit future lawful communications to a specified channel and reasonable time.
Identify the collector and the collection agency’s authority.
Provide an itemized statement of principal, interest, fees, penalties, and payments.
State what personal data it holds, the source, purpose, recipients, access history, and retention period.
Correct inaccurate data.
Block or delete data shown to have been unlawfully obtained, used for an unauthorized purpose, or no longer necessary, subject to any lawful retention requirement.
Notify previous recipients when correction or remedial notification is legally appropriate.
Preserve collection logs, account records, and relevant system data for the complaint.
Provide a written response within 15 calendar days.

The 15-day request is especially important for an NPC complaint.

How to complain to the SEC

The SEC is the primary regulator for ordinary lending companies, financing companies, their online lending platforms, and their collection agencies.

Use the SEC iMessage ticketing system and select:

Financing and Lending Companies Department → Complaints on Financing and Lending Companies

The current SEC iMessage user guide states that iMessage is the SEC’s official platform for inquiries and complaints and generates a ticket that can be tracked. An eSECURE account is required.

Attach, as applicable:

A clear narrative and timeline.
Valid government-issued identification.
Loan and disclosure documents.
Screenshots, messages, call logs, posts, and contact-recipient evidence.
Receipts and the lender’s balance computation.
Your written complaint to the company and its response.
The app-store listing and privacy notice.
The collector’s name, agency, numbers, and payment instructions.
Evidence identifying the lender’s legal corporate name.

File a separate, clearly organized complaint for each respondent company when multiple lenders are involved. Do not identify the respondent only by the app’s marketing name if the legal operator can be found.

The SEC’s published lending-company complaint procedure states that the respondent company is generally given 10 days from receipt to submit an answer or comment. That period is not a guaranteed deadline for the SEC’s final action.

The SEC may investigate and impose administrative sanctions. Under MC No. 18, the stated fines are:

Lending company: ₱25,000 for a first offense and ₱50,000 for a second offense.
Financing company: ₱50,000 for a first offense and ₱100,000 for a second offense.
Third offense: Depending on the circumstances and gravity, a fine of at least twice the second-offense fine but not more than ₱1 million, suspension of lending or financing activities for 60 days, or revocation of the company’s authority to operate.

Other sanctions may apply under separate laws. A willful violation of RA No. 11765 or its implementing rules or regulatory orders may, upon conviction, carry one to five years’ imprisonment, a fine of ₱50,000 to ₱2 million, or both. These consequences are not automatic; liability and the proper penalty depend on the proven facts and due process.

The SEC complaint does not by itself cancel the loan, rewrite payment terms, or declare the contract void.

How to complain to the National Privacy Commission

File with the NPC when the complaint involves unauthorized or excessive collection, access, use, retention, or disclosure of personal information—including copied contacts, harvested social-media connections, photos used for shaming, or messages sent to third parties.

The required first step

Under the 2021 NPC Rules of Procedure, you must ordinarily:

Inform the lender, its data protection officer, collection agency, or other responsible entity in writing about the privacy violation; and
Show that it failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice.

The NPC may waive this requirement for properly supported good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy, or patently illegal conduct. If urgent continued processing is causing serious harm, explain the urgency and why waiting would be unsafe or ineffective.

Preparing the formal complaint

Use the form and current instructions on the NPC’s formal complaint page. The complaint must generally be:

In writing, signed, verified, and notarized.
Filed by the affected data subject or an authorized representative with a special power of attorney.
Directed against an identified respondent, or supported by facts that may establish the respondent’s identity.
Accompanied by a factual narrative, documentary evidence, witness affidavits when available, and the relief requested.
Accompanied by your correspondence with the respondent and proof of its response or failure to respond.
Accompanied by a certification against forum shopping.
Supported by valid identification.
Prepared separately for each respondent.

The NPC accepts filing in person, by courier, or through the electronic channel identified on its current complaint page. Check the NPC’s posted schedule of fees before submission. The Rules recognize exceptions for qualifying indigent complainants and allow waiver for good cause upon proper request.

A privacy complaint may request correction, blocking, removal, destruction, or other appropriate relief, but erasure is not absolute. A lender may retain information that remains necessary for a legal obligation, the administration of an existing contract, or the establishment, exercise, or defense of legal claims.

Under NPC Circular No. 2022-01, administrative fines depend on the type and seriousness of the infraction and the respondent’s annual gross income. Major infractions may attract fines of 0.25% to 2%, while grave infractions may attract 0.5% to 3%; the total fine for a single processing act is capped at ₱5 million. Administrative fines do not replace the separate criminal offenses in Sections 25 to 33 of the Data Privacy Act. Criminal penalties can be imposed only through the proper judicial process.

When the BSP is the correct regulator

Use the BSP’s complaint process only when the lender or financial service involved is a BSP-supervised institution, such as a bank, digital bank, or regulated e-money issuer. An ordinary online lending or financing company is generally under the SEC, even if it disburses or receives payments through a bank or e-wallet.

For a BSP-supervised institution:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel.
If the response is unsatisfactory, escalate through the BSP Online Buddy on the BSP website or follow the alternative filing instructions in the BSP Consumer Assistance Mechanism guide.
Include proof that you first approached the supervised institution.

A complaint against the payment platform does not replace a separate SEC or NPC complaint against the lending company that committed the harassment or privacy violation.

If the lender appears unlicensed or uses a false identity

A lending company must have SEC authority to operate; ordinary corporate registration alone is not sufficient. Look for the legal company name and SEC registration or authority details in the contract, disclosure statement, privacy notice, app listing, website, and payment instructions.

If the app refuses to identify its legal operator, uses several inconsistent company names, demands payment to unrelated personal accounts, or cannot show authority to operate:

State those facts in the SEC complaint.
Attach every name, app link, website, phone number, bank or e-wallet account, and collector identity.
Ask the SEC through iMessage for verification of the company’s authority or status.
Report any unauthorized personal-data processing to the NPC. NPC Circular No. 2020-01 applies to persons acting as lenders even when they lack the required SEC authority.
Report possible fraud, impersonation, or cybercrime to law enforcement.

Do not assume that an app is authorized merely because it appears in an app store.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Submitting only isolated screenshots that omit the sender, date, time, and context.
Naming only the app instead of identifying the legal company operating it.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Paying a collector’s personal account without verifying the payment channel with the lender.
Sending sensitive IDs, passwords, PINs, one-time passwords, or full card details to an alleged investigator or collector.
Filing an NPC complaint without first sending written notice to the respondent or explaining why the requirement should be waived.
Omitting proof that the respondent received the written notice.
Combining several unrelated lenders into one disorganized complaint.
Assuming that revoking phone permission also deletes information previously copied.
Ignoring a legitimate court summons or formal legal notice because the collector previously behaved unlawfully.
Assuming that filing a regulatory complaint erases the debt or automatically stops contractual charges.
Posting unredacted evidence publicly and thereby exposing your own—or another person’s—private information.

When legal help is urgent

Consult a Philippine lawyer promptly when:

The collector has made a credible threat of violence, abduction, property damage, or stalking.
Intimate photographs, fabricated sexual images, medical information, government IDs, or information about a child have been published or threatened with publication.
The lender has contacted many relatives, co-workers, clients, or an employer.
Your identity, account, SIM, email, or social-media profile has been taken over.
You need an urgent NPC temporary ban on processing or a court remedy.
You have received a subpoena, summons, formal demand, or notice from a prosecutor or court.
You seek damages or must coordinate related SEC, NPC, civil, and criminal proceedings.
The lender’s balance, interest, penalties, or payment records materially differ from your documents.
Several companies or collectors appear to be sharing your data.
You are being asked to sign a waiver, settlement, acknowledgment of debt, or restructuring agreement you do not understand.

The Constitution provides that no person may be imprisoned solely for debt. That protection does not prevent prosecution for a separate offense supported by evidence, such as fraud. A collector’s blanket claim that nonpayment alone will automatically result in arrest is therefore misleading. See Article III, Section 20 of the 1987 Constitution.

Frequently asked questions

Do I still have to pay if the lender harassed me?

A complaint does not automatically extinguish a valid debt. Ask for an itemized balance, dispute incorrect amounts in writing, and use only a verified official payment channel. Harassment and the enforceability or amount of the debt are separate issues.

Can the app contact my family, friends, employer, or co-workers?

It may not scrape the phone’s contact list and message people to shame or pressure you. A properly identified guarantor, co-maker, or chosen character reference is different, but the person’s role and the purpose of contact matter. Being a relative, friend, or saved contact does not make someone liable for the debt.

I gave the app permission to access contacts. Can I still complain?

Yes. App permission is not blanket consent to excessive collection, harvesting, indefinite storage, harassment, or public disclosure. The lawfulness of the processing depends on its purpose, necessity, transparency, and proportionality.

Can I complain if I am only a contact person and not the borrower?

Yes, if the app collected, used, or disclosed your personal information unlawfully. You are a data subject with your own privacy rights. Preserve the message and ask the sender how it obtained your details.

What if I never completed the application or my loan was rejected?

Privacy obligations still apply. The lender must have a lawful purpose and retention policy and cannot keep or exploit the applicant’s data indefinitely merely for possible future use.

Can collectors call late at night?

Contact before 6:00 a.m. or after 10:00 p.m. is generally an unfair practice under SEC MC No. 18, subject to its stated exceptions for accounts more than 15 days past due or the borrower’s express agreement about contact time. Those exceptions do not authorize threats, insults, deception, or disclosure to third parties.

Can the lender outsource collection and deny responsibility?

No. SEC and NPC rules make the lender accountable for collection agents and service providers handling the account or personal data.

Do I need a lawyer to file with the SEC or NPC?

Not ordinarily. Both agencies provide filing procedures for individual complainants. Legal assistance becomes valuable when urgent orders, damages, criminal charges, multiple respondents, or overlapping proceedings are involved.

Is a social-media or app-store report enough?

No. Platform reporting may remove an app, post, or account, but it is not a substitute for an SEC, NPC, or law-enforcement complaint. Save the evidence before requesting removal.

How soon should I report?

As soon as the evidence is secured. For an NPC complaint, first give the respondent the required written opportunity to act and document the 15-calendar-day period unless you have grounds to request a waiver. Threats, extortion, hacking, and imminent publication should be reported to law enforcement immediately rather than waiting.

Official references

This article provides general legal information, not advice for a particular case. Outcomes and available remedies depend on the documents, evidence, parties, and surrounding facts. Official sources and procedures were checked as of 18 August 2026.