Quick answer

Report online lending app abuse to the agency that handles the particular violation:

Unfair collection, harassment, intimidation, or public shaming by a lending or financing company: file through the SEC iMessage portal under “Complaints on Financing and Lending Companies.”
Unauthorized access, use, retention, or disclosure of contacts, photos, messages, location, or other personal data: complain to the National Privacy Commission.
Threats of violence, extortion, impersonation, account takeover, fraud, or other possible crimes: report promptly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. Call 911 if anyone is in immediate danger.
An app operated by a bank or another BSP-supervised institution: complain first to the institution, then use the BSP Consumer Assistance Mechanism if unresolved.

You may report even if the loan is real and unpaid. A creditor may lawfully seek payment, negotiate, and use court remedies, but it may not collect through threats, humiliation, deception, or unlawful use of personal data. Reporting the abuse does not automatically cancel the debt, change the loan terms, or stop a legitimate court case.

What online lenders are not allowed to do

Under SEC Memorandum Circular No. 18, Series of 2019, the Data Privacy Act of 2012, and the NPC’s loan-processing rules, prohibited conduct can include:

Threatening violence, property damage, arrest, public exposure, or another action the collector cannot legally take.
Using obscene, insulting, intimidating, or humiliating language.
Posting or circulating a borrower’s name, photograph, identification document, alleged debt, fabricated “wanted” notice, or edited image to shame the borrower.
Messaging an employer, co-worker, neighbor, social-media contact, or other person merely because that person appears in the borrower’s phone.
Using a borrower’s photo to embarrass or pressure the borrower.
Requiring or retaining unnecessary access to contacts, camera, gallery, location, storage, or other protected phone resources.
Processing contacts in an unconstrained, excessive, or disproportionate way.
Misrepresenting the collector as a police officer, government employee, lawyer, court officer, or other person with authority the collector does not have.
Falsely presenting an ordinary demand letter or collection message as a warrant, subpoena, summons, or final court order.

The March 2026 joint DICT-NPC-SEC advisory expressly reiterates that contacting people in a borrower’s contact list for debt collection is prohibited unless the person was named as a guarantor.

Character references are not automatically guarantors

Under NPC Circular No. 2022-02:

A character reference may be contacted to verify the borrower’s identity or the truth of information supplied in the application.
A character reference may not automatically be treated as responsible for the loan.
A guarantor must have separately and expressly consented to assume responsibility if the borrower defaults.
For debt collection, the lender may contact the guarantor—not unrelated contacts or a character reference who never agreed to be a guarantor.

Giving an app permission is not unlimited consent

A permission granted during installation does not authorize every later use of the data. Consent must be informed and specific, and processing must remain lawful, necessary, proportionate, and connected to a legitimate purpose.

Limited access may sometimes be lawful—for example, using the camera for identity verification or letting a borrower select a reference or guarantor from a contact list. The app should turn off the permission, or prompt the user to revoke it, when the purpose has been completed. “Unbridled” contact-list processing, harassment, and collection from non-guarantors remain prohibited.

Withdrawing consent also does not necessarily require deletion of every record. A lender may retain information needed to perform the loan contract, meet a legal obligation, or establish or defend a legal claim. It must still stop processing that has no lawful basis or has become unnecessary or excessive.

What to do immediately

1. Protect yourself before responding

If a message contains a credible threat of physical harm, identifies your home or workplace, demands money through intimidation, or shows that an account has been taken over:

Call 911 or go to the nearest police station if danger is immediate.
Do not meet the collector alone.
Do not click unfamiliar links, install another app, share an OTP, or provide passwords, PINs, card details, or additional identification.
Verify any payment instruction through the lender’s official website or a previously verified account. Do not send money to a personal wallet solely because a threatening caller demands it.

2. Preserve the evidence before blocking or uninstalling

Create a secure copy outside the affected phone if possible. Preserve:

Screenshots showing the entire message, sender, account or number, date, and time.
Screen recordings showing the message thread, profile, URL, post, or app page in context.
Original emails with headers and original text or multimedia messages.
Call logs, voicemail, and recordings lawfully obtained.
Links and screenshots of public posts before asking the platform to remove them.
The app-store listing, developer name, package or app name, privacy notice, permissions requested, and version number.
The loan agreement, disclosure statement, payment schedule, receipts, account statement, and collection notices.
Proof of the amount actually received and every amount paid.
Names and contact details used by the collector and the company it claimed to represent.
Statements or screenshots from relatives, co-workers, or other people contacted.
Your written complaint to the lender and proof it was received.
A simple incident log listing each event chronologically.

Keep unedited originals. If you annotate or redact a copy for submission, retain the original separately. Avoid reposting the abusive material publicly because doing so may expose your own data, the data of contacts, or evidence needed in a complaint.

After preserving the evidence, review and revoke unnecessary app permissions. If account access may have been compromised, change passwords from a trusted device, enable multi-factor authentication, and contact the relevant bank, e-wallet, email provider, or mobile carrier.

Send a written demand to the lender

For privacy complaints, the NPC generally requires the data subject to notify the lender, its data protection officer, collection agency, or other responsible entity in writing and give it an opportunity to act.

Your notice should identify:

Your name and loan or account reference, using only the minimum information needed.
The app, lender, collection agency, numbers, and accounts involved.
The exact conduct complained of, with dates.
The personal data accessed, used, or disclosed.
The people contacted and what they were told.
The corrective action requested.

Depending on the facts, request that the company:

Stop threats, shaming, and contact with non-guarantors.
Remove unlawful posts and instruct recipients or processors to stop further disclosure.
Identify the lending company, collection agency, and personnel responsible.
State how it obtained and used your personal data and identify recipients of the data.
Restrict, block, correct, or delete data that was unlawfully obtained, used for an unauthorized purpose, inaccurate, or no longer necessary.
Preserve relevant call recordings, access logs, collector instructions, account notes, and data-disclosure records.
Use only a specified written channel for legitimate account communications.

Keep proof of delivery. Under the 2021 NPC Rules of Procedure, a privacy complaint may proceed when the respondent fails to take timely or appropriate action or gives no response within 15 calendar days from receipt of the written notice.

The NPC may waive prior notice for good cause or a serious violation—such as grave and irreparable harm, the absence of a plain and adequate remedy, or conduct that is patently illegal. Explain and prove why a waiver is necessary instead of simply omitting this step.

How to file with the SEC

Use the SEC iMessage portal, the SEC’s official ticketing system:

Create or sign in to an eSECURE account.
Select “Open A New Ticket.”
Choose “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.
Identify the company, app, and collection agency. If the operator is unknown, provide the app-store developer, payment account, phone numbers, websites, and other identifying information.
Describe the events in chronological order and specify the relief or investigation requested.
Upload the loan records and evidence of harassment.
Save the ticket number and monitor the portal for requests or replies.

The SEC iMessage user guide explains how to create, view, and reply to a ticket. The March 2026 joint advisory also lists the SEC hotline as 1-4732 (1-4SEC).

Report an app even if you believe it is unlicensed or unrecorded. State that clearly and provide the available identifiers. Lack of registration does not remove the NPC’s jurisdiction over unlawful personal-data processing.

The SEC may investigate and impose administrative sanctions, including fines and suspension or revocation of authority, when legally justified. It generally cannot use a complaint to rewrite the contract, cancel the debt, declare the loan void, or decide every private dispute over interest and payment.

How to file a privacy complaint with the NPC

A borrower or another person whose data was processed may complain. A representative generally needs a special power of attorney.

Use the current NPC complaint page and Complaints-Assisted Form. A formal complaint should:

Be written, signed, verified, and notarized in the required form.
Identify the complainant and respondent or provide facts that may lead to the respondent’s identification.
Narrate the material facts and identify the data involved.
Attach supporting documents and witness affidavits when available.
Attach the prior written notice and the respondent’s answer, or proof of no answer.
State the relief requested.
Include a sworn certification against forum shopping.

The certification must truthfully disclose related cases or claims. If you later learn that the same or a similar matter was filed elsewhere, the NPC rules require reporting that fact within five calendar days. Filing with both the SEC and NPC is not a reason to conceal either complaint; they address different regulatory issues, but overlapping proceedings must be disclosed accurately.

The NPC rules allow filing at an NPC office, personally, by registered mail, by courier, or through electronic mail when authorized. Because addresses and electronic channels can change, confirm them on the NPC contact page immediately before filing. Its listed office is currently at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City.

Current NPC fees

The current base filing fee is ₱500, plus the applicable legal research fee and any additional fee for a claim for damages. Have the NPC assess the amount before paying through an official channel. The 2025 Service Request and Assessment Form reflects these charges.

An indigent litigant may seek exemption, subject to the NPC’s documentary requirements. The published standard covers a litigant whose gross family income does not exceed twice the applicable monthly minimum wage and who does not own real property with a fair market value above ₱300,000. Required proof includes a barangay certificate of indigency, specified notarized affidavits, and the current tax declaration, if any.

When to consider a temporary ban

If unlawful processing is continuing and urgently threatens data-subject rights, a complainant may move for a temporary ban on processing when filing the complaint or before the NPC decision becomes final. The application must be in the prescribed form, supported by facts, notarized, and may require a bond. It suspends the main complaint while the application is resolved, so obtain legal advice when possible. The NPC provides a separate temporary-ban filing page.

When to report to cybercrime authorities

Report promptly when the conduct includes threats, extortion, fraudulent payment instructions, impersonation, unauthorized account access, identity misuse, forged legal documents, or coordinated online attacks.

The March 2026 government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

Provide copies of the evidence but retain your originals. Ask for a complaint, incident, or reference number. The precise criminal offense and filing procedure depend on the words used, intent, method, identity of the sender, and available proof; do not label the conduct as a particular crime unless the evidence supports every required element.

An administrative complaint does not replace a police or prosecutorial complaint where immediate threats or possible crimes are involved.

If the lender is supervised by the BSP

Ordinary lending and financing companies and their online platforms are generally directed to the SEC. If the app is operated by a bank, digital bank, or another BSP-supervised institution:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.
If unresolved or the response is unsatisfactory, escalate through the BSP Online Buddy or submit the BSP complaint form through the channels on the BSP Consumer Assistance page.

The BSP mechanism is a second-level recourse and does not replace a separate NPC complaint for privacy violations or a law-enforcement report for possible crimes.

Common mistakes that weaken a complaint

Deleting the app, thread, post, or call log before preserving it.
Submitting cropped screenshots that omit the sender, date, time, URL, or surrounding conversation.
Naming only the app’s brand without identifying the corporate operator, developer, collector, payment account, or phone numbers.
Reporting harassment without attaching the loan documents or account records needed to connect the collector to the lender.
Paying a personal account without first verifying that it belongs to an authorized collector.
Failing to notify the lender in writing before filing an NPC complaint, without explaining why a waiver should apply.
Using an outdated NPC or SEC address instead of checking the current official page.
Assuming that app deletion automatically removes data already copied to the lender’s systems.
Ignoring a genuine court summons because earlier collection messages were fake. Verify court documents directly with the named court and obtain legal help promptly.
Falsely stating that no other complaint is pending. Disclose related SEC, NPC, police, prosecutorial, or court proceedings when the form requires it.
Exaggerating facts or identifying an offense without evidence. A precise chronology is usually stronger than conclusions or insults.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if eligible, or another qualified legal-aid provider promptly when:

A credible threat identifies your location, family, workplace, or property.
Intimate images, identification documents, health information, or financial credentials were disclosed.
The lender continues mass messaging after receiving a written demand.
Your bank, e-wallet, email, or social-media account was accessed without authority.
You receive an authentic summons, subpoena, warrant, or prosecutor’s notice.
A lender seeks payment from someone who supposedly signed as guarantor but disputes the signature or consent.
You intend to claim substantial damages, seek an urgent processing ban, or pursue criminal charges.
Several lenders or collection agencies appear to be sharing your data.

Frequently asked questions

Can I complain even if I missed payments?

Yes. Default may permit lawful collection and court action, but it does not authorize threats, shaming, deception, or unlawful data processing.

Can I be jailed simply because I cannot pay an online loan?

The 1987 Constitution states that no person shall be imprisoned for debt. This does not immunize separate criminal conduct, if any, and it does not prevent a creditor from filing a civil case. Never ignore genuine legal process.

May a collector call my employer or relatives?

Not merely because their details appear in your phone. For debt collection, the NPC’s amended rules permit contact with a person who actually and expressly agreed to be a guarantor. A character reference may be contacted for verification, not automatically pursued for payment. Lawful court service, legally required disclosures, and other fact-specific legal bases are separate matters.

What if I tapped “Allow contacts”?

That does not authorize unconstrained copying, mass messaging, or harassment. Permission and consent remain subject to necessity, proportionality, transparency, and lawful purpose.

Should I uninstall the app?

Preserve the evidence and download your records first. Then revoke unnecessary permissions and uninstall if needed for security. Uninstalling does not cancel the loan or ensure deletion of information already stored elsewhere.

Is the lender responsible for an outside collection agency?

Outsourcing does not remove the lender’s data-protection accountability. The Financial Products and Services Consumer Protection Act also makes financial service providers responsible for authorized representatives and, in specified circumstances, solidarily liable with accredited third-party providers involved in debt collection.

Will filing a complaint erase the debt or guarantee damages?

No. Regulators decide violations and remedies after due process. Debt validity, contract terms, damages, administrative sanctions, and criminal liability are separate questions that depend on the documents and proven facts.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Procedures and conclusions may depend on the loan documents, identity of the regulated entity, evidence, and surrounding facts. Official sources and channels were checked as of 11 August 2026.