Quick answer

You can report online lending app harassment to the Securities and Exchange Commission (SEC) and report misuse or disclosure of personal data to the National Privacy Commission (NPC). If the messages contain threats of violence, extortion, impersonation, hacking, or other possible crimes, preserve the evidence and report promptly to the police or the National Bureau of Investigation Cybercrime Division.

These remedies may be pursued at the same time because they address different conduct. Filing a complaint does not automatically cancel a valid loan, suspend agreed payment obligations, or authorize you to ignore lawful collection notices. Harassment and privacy abuse remain reportable even when a debt is genuinely overdue.

What conduct may be reported?

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited unfair debt-collection practices include:

Using or threatening violence or other criminal means against a person, reputation, or property
Threatening action that cannot legally be taken
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense
Publishing or disclosing the borrower’s name or personal information, except where disclosure is lawfully permitted
Communicating false loan information, including failing to say that a debt is disputed when the collector knows or should know this
Using false representations or deceptive means to collect a debt or obtain information
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions for accounts more than 15 days past due or times expressly accepted by the borrower through written, electronic, or recorded consent
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers

A demand for payment is not automatically harassment. A lender may ordinarily contact the borrower, state the amount it claims is due, send lawful reminders, and pursue remedies allowed by the contract and law. The issue is the method used, the truthfulness of the communication, the people contacted, and how personal data was obtained or disclosed.

Privacy rules for online lending apps

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality. A borrower’s consent to some processing does not give a lender unlimited authority to copy, retain, disclose, or weaponize everything on the borrower’s phone.

Under NPC Circular No. 2022-02, which amended the rules for loan-related transactions:

An app may request access only when it is suitable, necessary, and not excessive for a legitimate purpose.
Processing through permissions—such as access to contacts, the camera, or a photo gallery—should begin only when the information is needed.
Once permission is no longer necessary and no other lawful basis applies, the app should turn it off or tell the borrower that it may be revoked.
A borrower’s photograph must not be used to harass or embarrass the borrower in collecting a delinquent loan.
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited, including processing that leads to harassment or debt collection from people other than guarantors.
The app must provide a separate way for the borrower to choose any character references or guarantors, with access limited to the minimum necessary for that selection.
A character reference may be contacted to verify the applicant’s identity and information, but must not automatically be treated as a guarantor.
A guarantor must have expressly agreed to act as one. For debt collection, the lender may contact the guarantor, but not unrelated people found in the borrower’s contact list.

A borrower is responsible for informing a person named as a character reference. However, that does not permit the lender to shame the reference, disclose unnecessary loan details, market products to the reference, or treat the reference as liable for the debt.

Preserve evidence before blocking, deleting, or uninstalling

Save evidence as soon as possible. Messages, accounts, and app listings can disappear.

Keep:

Full-page screenshots showing the message, sender, phone number or account, date, and time
Screen recordings showing the message thread, profile, URL, or app interface
Voicemail and call recordings lawfully available to you, plus call logs
Texts or posts sent to relatives, co-workers, employers, references, or other contacts
Written statements and screenshots from those recipients
The app’s exact name, developer, download page, version, and requested permissions
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and collection-agency details, if displayed
Loan agreement, disclosure statement, promissory note, repayment schedule, receipts, and proof of payments
Advertisements or representations that induced you to borrow
Privacy notice, consent screens, and permission prompts
Your written complaints to the lender, app operator, data-protection officer, or collection agency, together with delivery and receipt records
Any reply, ticket number, acknowledgment, or proposed resolution
A short chronology identifying what happened, when, through which account, and who received each disclosure

Retain original files. Avoid cropping away identifying details. Back up copies in a secure location, but do not repost abusive messages publicly if doing so would expose your own or another person’s private information.

Take immediate protective measures

After preserving evidence:

Review and revoke unnecessary permissions for contacts, photos, camera, microphone, location, files, or social media.
Change passwords for your email, app-store, banking, and social-media accounts if unauthorized access is suspected.
Enable multi-factor authentication where available.
Inform affected contacts that the messages came from a collector and ask them not to engage, click links, send money, or disclose information.
Report the app or account through the app store, messaging platform, or social network. This may help remove harmful content, but it does not replace a government complaint.
Communicate with the lender in writing. Request its complete corporate identity, an itemized statement of account, the basis for disputed charges, and the name of any third-party collector.
If you intend to pay, use only a verified payment channel belonging to the lender. Do not send funds to an unverified personal account merely because a collector threatens you.

Do not retaliate with threats, publish collectors’ private information, or alter screenshots. Avoid promising a payment date you cannot meet. If the amount is disputed, say precisely which amount or charge you dispute rather than denying everything without checking the documents.

How to complain to the SEC

The SEC generally handles complaints involving lending and financing companies, including unfair collection practices and violations of the Lending Company Regulation Act, Financing Company Act, and Truth in Lending Act.

Use the SEC complaint instructions and official complaint form. The SEC presently instructs complainants to:

Complete the form fully and accurately
File one complaint form for each respondent company
Attach a copy of a valid government-issued ID
Include supporting documents and evidence

The SEC lists personal filing and email filing. Its official complaints page provides the current address, form, and submission instructions; the listed complaints email is flcd_complaints@sec.gov.ph. For email submissions, use the SEC’s required subject format:

COMPLETE NAME_RESPONDENT COMPANY_SUBJECT OF COMPLAINT

Identify the app, the corporation operating it, and any collection agency if known. Describe each incident with dates and attach a labeled evidence index. Explain what action you want the SEC to consider, such as investigating unfair collection conduct or verifying whether the company is authorized to operate.

The SEC may investigate and impose regulatory sanctions where warranted. It expressly states, however, that its complaints process cannot change the loan’s payment terms, declare an interest rate void, invalidate the contract, or cancel or settle the debt. Those issues may require a separate agreement, court proceeding, or individualized legal advice.

How to complain to the National Privacy Commission

First notify the responsible entity in writing

As a general rule, before filing with the NPC, notify the lender, app operator, collection agency, or other responsible entity in writing about the privacy violation. Give it an opportunity to act.

Under the 2021 NPC Rules of Procedure, you may ordinarily proceed when the entity fails to take timely or appropriate action, or does not respond within 15 calendar days after receiving your written notice. Keep proof of receipt and attach it to the complaint.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain, speedy, or adequate remedy from the respondent, or conduct that is patently illegal. Waiver is discretionary: explain and prove why it is needed rather than assuming the waiting period never applies.

Your written notice should identify:

The data involved
How it was collected, accessed, used, or disclosed
The people who received it
Why you believe the processing was unauthorized, excessive, or unrelated to a legitimate purpose
The corrective action requested, such as stopping disclosure, removing a reference’s data, restricting processing, correcting inaccurate information, or explaining the lawful basis and recipients

Prepare and file the formal complaint

Follow the NPC’s current complaint mechanics and formal filing guide. The NPC requires a properly completed and notarized complaint-assisted form or another verified complaint, together with supporting evidence and witness affidavits where applicable.

A formal complaint should clearly identify the parties, narrate the material facts, specify the alleged privacy violation, attach the correspondence with the respondent, and include the required verification and certification against forum shopping. A representative generally needs a special power of attorney.

The NPC lists filing:

Personally
By registered mail
By courier
By authorized electronic mail

The official filing guide identifies complaints@privacy.gov.ph for scanned email submissions. Electronic documents should be digitally signed and in PDF format if practicable, subject to the NPC’s procedural requirements. Check the official page and form immediately before filing because fees, addresses, formatting rules, and electronic-filing instructions may change.

Incomplete complaints, complaints without adequate evidence, and complaints that fail to give the respondent an opportunity to act may be dismissed outright. If urgent harm justifies bypassing the ordinary notice process, expressly request a waiver and attach evidence supporting urgency.

When the lender may be under BSP supervision

Most complaints against independent lending or financing companies belong with the SEC. If the lender is a bank or another institution supervised by the Bangko Sentral ng Pilipinas, first complain through that institution’s consumer-assistance channel. If unresolved, use the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the official complaint form and channels listed there.

Do not assume that use of an e-wallet makes the lender itself BSP-supervised. Identify the entity named as creditor in the agreement and verify which regulator supervises it.

When police or NBI help is urgent

Contact local police or call 911 immediately if a message presents an imminent risk to life, safety, or property. Do not arrange an in-person meeting with a threatening collector by yourself.

Promptly seek assistance from law enforcement when the facts may involve threats, extortion, stalking, unauthorized account access, identity theft, impersonation, falsified documents, or publication intended to cause criminal harm. Online conduct may fall under the Cybercrime Prevention Act of 2012 when an offense defined by the Revised Penal Code or a special law is committed through information and communications technology. The exact offense depends on the words used, context, intent, authorship, and available evidence.

The NBI provides an online complaint page and official guidance for investigative assistance to victims of computer crimes. A victim may also approach the NBI Cybercrime Division, an NBI regional office, or the appropriate police cybercrime unit. Bring original devices if requested, but make secure backups first and obtain a receipt for any device surrendered.

Common mistakes that weaken a complaint

Naming only the app without identifying the corporation behind it
Deleting or uninstalling the app before recording its details and permissions
Submitting isolated cropped screenshots without dates, sender details, or context
Omitting the loan agreement and payment history because the complaint concerns harassment
Filing an NPC complaint without first giving written notice or explaining why waiver is justified
Treating a platform report as if it were an SEC, NPC, or criminal complaint
Combining different companies in one SEC complaint form
Claiming that every collection reminder is illegal
Assuming harassment automatically erases the loan
Paying a collector through an unverified personal account
Posting evidence publicly and exposing additional personal data
Ignoring official orders, requests for comment, or filing deadlines after a case begins

When to consult a lawyer promptly

Individual legal advice is especially important when:

A collector threatens arrest, physical harm, seizure of property, or public exposure
Intimate images, fabricated posts, or identity documents have been distributed
Your employer, clients, children, or unrelated contacts are being targeted
Money was taken from an account without authorization
A summons, subpoena, court pleading, or official government order has arrived
The lender’s identity cannot be established
The claimed balance is materially different from the contract or payment records
You need an injunction, damages, a temporary ban on processing, or another urgent remedy
Several proceedings may involve the same facts and a certification against forum shopping is required
You are considering signing a settlement, waiver, acknowledgment of debt, or restructuring agreement

The Public Attorney’s Office may be an option for persons who satisfy its eligibility and merits requirements. Law-school legal-aid clinics and Integrated Bar of the Philippines legal-aid services may also be available.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. The privacy rules prohibit unbridled processing of contact lists. For debt collection, lenders may contact a person who validly agreed to be a guarantor, but may not use the borrower’s general contact list to pursue unrelated people. A character reference is not automatically a guarantor.

Is contacting my employer automatically illegal?

It depends on why the employer was contacted, what was disclosed, and whether the employer or a particular person validly became a guarantor or co-maker. Shaming you, disclosing unnecessary loan information, or contacting unrelated workplace personnel may support an SEC or NPC complaint.

Does tapping “Allow contacts” authorize collection calls to everyone?

Not by itself. Consent and app permissions do not remove the requirements of lawful purpose, necessity, transparency, and proportionality. The NPC rules specifically prohibit excessive contact-list processing and debt collection from people outside the permitted categories.

Can the lender post my name or photograph because I missed a payment?

SEC rules generally prohibit publishing borrowers’ names and personal information as a collection tactic, subject to lawful exceptions. NPC rules expressly prohibit using a borrower’s photograph to harass or embarrass the borrower in collecting a delinquent loan.

Can I complain if I never borrowed but collectors keep messaging me?

Yes. Tell the sender in writing that you are not the borrower or guarantor, request the source and removal of your data, and preserve the messages. You may complain to the NPC about improper processing and to the SEC about the collector’s conduct. Report threats or suspected identity theft to law enforcement.

Should I stop paying while the complaint is pending?

A complaint does not automatically suspend a valid debt. Continue reviewing lawful payment obligations and use verified channels. If the balance or contract is disputed, state the dispute in writing and seek legal advice appropriate to the documents.

Can I file with both the SEC and NPC?

Yes, when the facts involve both unfair collection and misuse of personal data. Describe the same events consistently, disclose other pending proceedings when required, and tailor each complaint to that agency’s jurisdiction.

Is there a fixed deadline for reporting?

Do not delay. Different administrative, civil, and criminal claims may have different prescriptive periods, and digital evidence can disappear quickly. The 15-calendar-day NPC rule is ordinarily a waiting period after written notice to the respondent—not a general deadline allowing a complainant to postpone preserving evidence or seeking emergency help.

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the messages, loan documents, parties, evidence, and applicable procedural rules. Official sources and filing information were checked as of 26 August 2026.