Quick answer

Harassment by an online lending app can be reported to the Securities and Exchange Commission (SEC). If the lender accessed your contacts, disclosed your debt, posted your personal information, or misused your photos or other data, you may also complain to the National Privacy Commission (NPC). Report threats, fraud, extortion, impersonation, or other possible crimes immediately to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the nearest police station.

A lender may demand payment of a valid debt and pursue lawful collection or a civil case. It may not threaten violence, publicly shame you, lie about criminal charges, use abusive language, or contact unrelated people to pressure you. Filing a harassment complaint does not automatically cancel the loan, but owing money does not remove your rights to privacy, dignity, and fair treatment.

What online lending-app conduct may be unlawful?

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, prohibits abusive collection or debt-recovery practices. SEC Memorandum Circular No. 18, Series of 2019, specifically regulates debt collection by financing and lending companies and their third-party collectors.

Potentially reportable conduct includes:

Threatening to kill, injure, abduct, assault, or otherwise harm you, your family, your reputation, or your property
Threatening an action that cannot legally be taken
Claiming that a warrant, criminal case, court order, or government complaint already exists when that is false
Pretending to be a police officer, lawyer, court employee, government official, or process server
Using obscenities, degrading insults, or profane language to abuse or intimidate you
Posting your name, photograph, identification document, loan details, or edited “wanted” image online
Sending your debt information to your employer, co-workers, relatives, friends, or social-media contacts merely to shame or pressure you
Contacting people in your phone list who are not guarantors or otherwise legally responsible for the debt
Telling other people false information about the amount, status, or circumstances of your loan
Using deception to collect money or obtain information about you
Repeatedly calling at unreasonable hours or in a manner designed to harass
Using a borrower’s photograph, camera access, contact list, or social-media information for public shaming
Continuing unauthorized or excessive processing of personal data after its legitimate purpose has ended

SEC Memorandum Circular No. 18 generally treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable. Its stated exceptions include accounts past due for more than 15 days and documented borrower consent to contact at those times. These exceptions do not permit threats, public shaming, deception, excessive calls, or unauthorized contact with other people.

Character references are not automatically guarantors

A character reference usually provides identity or background information. A guarantor separately agrees to answer for the debt under the applicable agreement. The government’s March 2026 joint advisory states that lending platforms must distinguish between character references and guarantors and that a guarantor must expressly consent to that role.

A lender should not treat every person selected from your contacts as a guarantor. For debt collection, it may not contact random phonebook entries, relatives, colleagues, or character references as though they were liable for your loan.

App access is not unlimited consent

Under Republic Act No. 10173, the Data Privacy Act of 2012, and NPC Circular No. 20-01 as amended by NPC Circular No. 2022-02:

Data collection must have a lawful, specific, and proportionate purpose.
An app cannot rely on vague or bundled consent for unlimited access to personal data.
Access to a camera or photo gallery must be limited to legitimate purposes such as identity verification or know-your-customer checks.
Contact-list access cannot be unrestrained or used to harvest people for debt collection and harassment.
When an app permission is no longer needed, the borrower should be prompted to turn it off or revoke it.
Borrower data should be retained only for as long as necessary for its lawful purpose, legal claims, or a period required by law.

Uninstalling an app or revoking permission stops future device access but may not erase information the company already copied. A written access, objection, correction, or deletion request may therefore be necessary.

Where should you report online lending harassment?

Different agencies handle different parts of the problem. You may file with more than one office when the facts overlap.

Problem	Appropriate office	Official channel
Abusive collection by a lending or financing company or its collector	SEC Financing and Lending Companies Department (FINLEND)	SEC iMessage complaint portal or hotline 1-4732 (1-4SEC)
Contact harvesting, disclosure of debt, misuse of photos, or other personal-data violation	National Privacy Commission	NPC complaint-filing page and complaints@privacy.gov.ph
Threats, fraud, scams, impersonation, extortion, or other possible cybercrime	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline	acg@pnp.gov.ph, ccd@nbi.gov.ph, or 1326@dict.gov.ph
Loan offered by a bank, e-money issuer, or another BSP-supervised institution	Provider’s consumer-assistance unit, then BSP	BSP consumer-assistance channels
Immediate physical danger	Emergency services or nearest police station	Call 911 or go directly to the police

The SEC regulates ordinary lending and financing companies. The BSP route is more appropriate when the actual credit provider is a bank or another BSP-supervised financial institution. A brand name, app name, payment processor, and legal lender may be different entities, so check the loan agreement and disclosure statement.

What to do immediately

1. Protect yourself first

If a message contains a credible threat of immediate violence, identifies your location, threatens your children, or suggests that someone is on the way to your home or workplace:

Call 911 or the nearest police station.
Inform household members, building security, or your employer’s security office.
Do not meet the collector alone.
Do not open suspicious links or install another app sent by the collector.
Do not disclose one-time passwords, PINs, passwords, card details, or identification documents.

You do not need to wait for the lender’s internal investigation or the NPC’s 15-day response period before reporting an urgent threat to law enforcement.

2. Preserve evidence before blocking or uninstalling

Save evidence while the messages, account, and app information are still available. Preserve:

Full screenshots showing the sender, phone number or account, message, date, and time
Screen recordings that show the conversation in sequence
Original SMS, chat, email, voice message, and call-log records
URLs and screenshots of public posts, comments, profiles, and advertisements
The app’s exact name, developer, store listing, version, and requested permissions
The lender’s corporate name, SEC registration number, Certificate of Authority details, business address, and customer-service information
Loan agreement, disclosure statement, privacy notice, repayment schedule, and account statement
Proof of payments, receipts, bank or e-wallet transaction references, and demand letters
Names and numbers used by collectors
Screenshots supplied by relatives, co-workers, or other people who were contacted
Copies of complaints previously sent to the lender and proof of delivery

Keep the original files. Avoid editing, drawing on, or cropping the only copy. If you need to highlight something, make a duplicate. Back up the evidence to another device or secure cloud account.

Ask people who received collection messages not to delete them. If a formal case follows, their affidavits may help prove what was disclosed and how they received it.

3. Identify the actual lender

The app’s marketing name may not be the company that legally granted the loan. Look for the corporate lender in:

The loan agreement
The disclosure statement
The privacy notice
The repayment instructions
The app-store developer information
Collection emails and demand letters

Use the SEC’s Check with SEC service to verify whether the company is registered and authorized. Registration as an ordinary corporation is not necessarily authority to operate as a lending or financing company.

Report an apparently unlicensed lender to the SEC even if you have not completed every internal complaint step.

4. Send a written complaint to the lender

For ordinary consumer redress, first use the lender’s official consumer-assistance mechanism. Republic Act No. 11765 requires financial service providers to maintain a free complaint-handling mechanism.

Your written complaint should:

Identify you, the loan account, app, company, and collector
List each incident with its date and time
Identify people who received your loan information
State which information was posted, accessed, or disclosed
Say whether you admit the balance, dispute it, or need an itemized statement
Demand that unlawful contact, threats, and public disclosure stop
Request preservation of relevant records, including collector logs
Request the collector’s full name or true identity
Ask for a written response and complaint reference number
Request correction or deletion only to the extent allowed by law and consistent with legitimate record-retention or legal-claim requirements

Send the complaint through the company’s published email, in-app support channel, or consumer-assistance desk. Preserve proof of delivery. Do not send it only to the collector who is harassing you.

How to file a complaint with the SEC

The government’s current official channel for unfair collection complaints against lending and financing companies is the SEC iMessage portal.

Create or sign in to your iMessage account.
Open a new ticket.
Route the complaint to the SEC office handling financing and lending companies or FINLEND.
Identify both the app’s trade name and the lender’s complete corporate name.
Provide a short chronological statement rather than only saying, “The app harassed me.”
Attach readable copies of the loan documents, screenshots, payment records, and prior complaint.
State the relief requested, such as an investigation, an order to stop abusive collection, correction of records, or appropriate regulatory action.
Save the ticket number and copies of everything submitted.

If the collector claims to be an independent collection agency, name that agency when known. The lender cannot automatically avoid responsibility by outsourcing collection. Under Republic Act No. 11765, a financial service provider is responsible for acts or omissions of its representatives and may be solidarily liable with an accredited third-party provider involved in debt collection.

The SEC may investigate and impose administrative sanctions, including fines or suspension or revocation of authority where legally justified. A complaint does not guarantee damages, a refund, or cancellation of the debt.

How to file a privacy complaint with the NPC

A formal NPC complaint has stricter requirements than an ordinary email report.

First inform the company in writing

Under the 2021 NPC Rules of Procedure, as amended in 2024, you generally must first inform the lender or other responsible entity in writing of the privacy violation. The company must be given an opportunity to act. You may proceed if it fails to take timely appropriate action or does not respond within 15 calendar days after receiving your written notice.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy, or conduct that is patently illegal. Explain and prove why a waiver is necessary rather than simply skipping the requirement.

Prepare the formal complaint

Use the NPC’s current Complaints-Assisted Form or a properly verified complaint. Ordinarily, it must be notarized and should include:

Your identity and contact details
The respondent’s legal identity and service address, if known
A detailed statement of material facts
The particular personal data collected, used, or disclosed
Supporting documents and witness affidavits, if any
All relevant correspondence with the respondent
Proof that the respondent received your written privacy complaint
The action taken by the respondent, if any
The relief you want the NPC to grant
A certification against forum shopping
A copy of an accepted government-issued ID
Authority documents if someone files for you

The current form instructs complainants to submit one complaint form per respondent. If the lending company and a separate collection company independently processed your data, determine whether each must be named and supported by its own form.

Submit and pay the assessed fee

The NPC accepts complaints personally, by registered mail, by courier, or by authorized electronic filing. Its public instructions allow a scanned, notarized complaint to be emailed to complaints@privacy.gov.ph.

NPC Circular No. 2023-01 lists a basic complaint filing fee of ₱500, with additional fees for damages claims and certain applications. Indigent complainants may seek exemption subject to the NPC’s documentary requirements. Current payment instructions require submission of the Service Request and Assessment Form with the complaint, waiting for the assessed amount, and paying through the designated government payment facility. Do not transfer money to an unofficial account sent through social media.

The NPC may require corrections or additional documents. Its amended rules allow initial evaluation and possible outright dismissal when a complaint lacks the required form, evidence, respondent identification, or proof that the company had an opportunity to respond. Formal investigation and decision may take longer than the preliminary periods stated in the rules.

When to report to the PNP, NBI, or DICT

Regulatory complaints do not replace a criminal investigation. Report promptly when collectors:

Threaten violence, abduction, sexual harm, arson, or property damage
Demand payment in exchange for not publishing private information
Impersonate police, prosecutors, courts, or government agencies
Create false warrants, subpoenas, case numbers, or criminal complaints
Hijack accounts or make unauthorized financial transactions
Use malware, phishing links, or stolen credentials
Publish potentially defamatory accusations online
Persistently target you or your family in a way that may constitute a criminal offense

Depending on the exact words, conduct, intent, and evidence, possible laws may include Article 282 on grave threats, Article 287 on unjust vexation, or the provisions on libel and other offenses under the Revised Penal Code. Republic Act No. 10175, the Cybercrime Prevention Act of 2012, may apply when a Revised Penal Code offense or cybercrime is committed through a computer system. The police, prosecutor, and courts—not the lender or complainant—ultimately determine the proper offense.

The March 2026 DICT-NPC-SEC advisory lists these channels:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph; telephone (02) 8723-0401 local 7491
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (02) 8523-8231 to 38
DICT Cyber Hotline: 1326@dict.gov.ph

Bring or attach a valid ID, a chronological account, original electronic evidence, the lender’s identifying details, and information showing why the threat or representation is false. Obtain a complaint or reference number.

If the loan provider is supervised by the BSP

If the lender is a bank, digital bank, e-money issuer offering credit, or another BSP-supervised institution, first complain through that institution’s Financial Consumer Protection Assistance Mechanism.

If its response is unsatisfactory or it does not act within a reasonable period, escalate through the BSP Online Buddy on the BSP website or submit the BSP Complaint/Inquiry/Reply Form to consumeraffairs@bsp.gov.ph with proof that you first used the institution’s complaint mechanism.

The BSP route does not prevent a separate NPC complaint for data misuse or a police report for threats.

What if you are abroad or not a Filipino citizen?

Online filing makes it possible to submit SEC and NPC complaints while abroad, but jurisdiction and document formalities still matter.

Keep Philippine phone numbers, contracts, payment records, and messages showing the connection to a Philippine lender.
A representative filing an NPC complaint for a data subject generally needs a special power of attorney.
The amended NPC rules expressly allow a non-resident Filipino citizen without a Philippine representative to submit a complaint notarized through a Philippine embassy or consulate or accompanied by an apostille from the country of origin.
A foreign national may still be protected when the processing and responsible entity fall within the Data Privacy Act’s scope, but cross-border facts can affect jurisdiction and enforcement.
If documents are executed or notarized abroad, confirm the NPC’s current authentication and apostille requirements before submission.
Foreign-language evidence should be accompanied by a reliable English or Filipino translation when its meaning is important.

Does reporting harassment erase the debt?

No. Keep the collection conduct separate from the accounting dispute.

A valid lender may still:

Send a lawful demand letter
Report credit information through legally authorized channels
Engage a legitimate collection agent
Negotiate payment or restructuring
File an appropriate civil action
Enforce valid security or guarantees through lawful procedures

Article III, Section 20 of the 1987 Constitution states that no person may be imprisoned merely for debt. This does not prevent civil collection, and it does not protect separate fraudulent or criminal acts, if any. A collector’s message claiming that ordinary nonpayment alone automatically results in arrest is misleading.

If you dispute the balance, request an itemized statement showing the principal, interest, fees, payments, and computation. Continue preserving proof of any undisputed payments. Never pay into a collector’s personal account without verifying that the lender authorized it and will issue an official receipt.

Possible remedies and outcomes

The appropriate remedy depends on the office and the evidence.

SEC proceedings may result in:

Regulatory investigation
Directions to correct collection practices
Administrative fines or other sanctions
Suspension or revocation of authority in serious or repeated cases

NPC proceedings may result in:

Orders concerning unlawful personal-data processing
Correction, blocking, deletion, destruction, or other protection where legally proper
Compliance or enforcement orders
Administrative fines
Referral for possible criminal prosecution under the Data Privacy Act
Damages where supported and within the NPC’s authority

Criminal proceedings may result in:

Investigation and evidence preservation
Referral to a prosecutor
Filing of charges if probable cause is established
Criminal penalties upon conviction

Civil Code Articles 19, 20, 21, and 26 may also support a fact-dependent civil claim for abuse of rights, unlawful injury, or interference with privacy and dignity. Actual damages should be supported by receipts and financial records. Claims for moral or other damages require evidence and are not automatically awarded merely because a complaint was filed.

Common mistakes that weaken a complaint

Deleting the app, account, or messages before preserving evidence
Submitting cropped screenshots that hide the sender, date, or context
Naming only the app instead of identifying the corporate lender
Sending a long emotional narrative without dates, exhibits, or a clear sequence
Combining several unrelated lenders in one complaint
Failing to show that third parties actually received the borrower’s information
Filing an NPC complaint without first notifying the company or explaining why that step should be waived
Omitting the NPC certification against forum shopping, notarization, ID, or proof of authority
Claiming that every collection call is illegal
Assuming that harassment automatically cancels principal, interest, or all contractual obligations
Paying an unknown collector’s personal account to stop threats
Publicly reposting other people’s phone numbers, IDs, or private messages while trying to expose the lender
Waiting for an administrative response despite an immediate threat to safety

Official legal and procedural sources

The principal official sources include:

Source check date: 6 August 2026.

Frequently Asked Questions

Can an online lending app contact everyone in my phonebook?

No. Current government guidance prohibits unrestrained contact-list processing and contacting people other than a properly consenting guarantor for debt collection. A character reference is not automatically a guarantor.

Can a collector message my employer?

A lender cannot disclose your debt to an employer merely to embarrass or pressure you. Different considerations may apply if the employer is legally involved in a valid arrangement or disclosure is required by lawful process, but ordinary employment does not make the employer responsible for your loan.

Can I report harassment even if I really owe the money?

Yes. Your payment obligation and the collector’s conduct are separate issues. A valid debt does not authorize threats, deceptive claims, public shaming, or unlawful use of personal data.

Can I be arrested for failing to pay an online loan?

Ordinary nonpayment of debt does not by itself result in imprisonment. A lender may pursue lawful civil remedies. Separate conduct—such as fraud or another independently punishable act—must be established under the applicable law and legal process.

Should I block the collector?

Preserve all evidence first. You may then block abusive numbers for safety, but keep at least one official written channel open with the company so legitimate account communications and complaint responses can be documented.

What if the app already contacted my relatives?

Ask each recipient to preserve the original message, sender details, date, time, and screenshots. Include a list of recipients in your SEC and NPC complaints. A witness affidavit may later be required.

Can I ask the app to delete all my data?

You may object to unlawful processing and request deletion of data that is no longer necessary. The lender may retain information needed for an outstanding loan, compliance duties, or the establishment, exercise, or defense of legal claims. Ask it to explain the legal basis and retention period for information it refuses to delete.

How long will a complaint take?

There is no reliable single timeline. The NPC rules specify periods for certain preliminary steps, comments, and submissions, but complete investigation, mediation, enforcement, and decision may take longer depending on evidence, service on respondents, caseload, and procedural issues. SEC and criminal investigations likewise vary. Preserve reference numbers and follow up through the same official channel.

Do I need a lawyer?

A lawyer is not always required to submit an SEC ticket, lender complaint, or initial police report. Legal help becomes especially important when there is a credible threat, public disclosure of sensitive information, identity theft, a formal court document, a large disputed balance, several respondents, or a contemplated claim for damages.

Key Takeaways

Report abusive lending or financing-company collection to the SEC through iMessage.
File separately with the NPC when personal data, contacts, photographs, or loan information were misused or disclosed.
Report credible threats, fraud, impersonation, or other possible crimes immediately to the police, PNP Anti-Cybercrime Group, NBI, or DICT.
Preserve complete original evidence before blocking numbers, deleting accounts, or uninstalling the app.
Identify the corporate lender, not only the app’s marketing name.
A character reference is not automatically a guarantor, and unrelated contacts should not be pressured for payment.
A valid debt may still be collected through lawful means, but it does not justify harassment or public shaming.
For an NPC complaint, observe the written-notice requirement, 15-calendar-day response period, notarization, supporting-document, fee, and forum-shopping requirements unless a legally recognized exception applies.