Quick answer

If an online lending app, financing company, lending company, or collection agent is threatening you, publicly shaming you, contacting people in your phone without a lawful reason, or misusing your personal data:

Preserve the evidence before deleting the app or messages.
Send a written complaint to the lender and its data protection officer.
Report unfair collection practices to the Securities and Exchange Commission through the SEC iMessage portal.
Report unlawful collection, disclosure, or use of personal data to the National Privacy Commission. Ordinarily, you must first notify the respondent in writing and allow up to 15 calendar days for an appropriate response.
Contact law enforcement immediately if there are credible threats of violence, extortion, identity theft, account hacking, impersonation, or other possible crimes.

You may use more than one remedy when the conduct raises separate lending, privacy, and criminal issues. However, disclose any related complaints or proceedings when a form requires it.

Reporting harassment does not automatically cancel a valid loan, stop interest authorized by law and the agreement, or prevent lawful collection. It also does not excuse the lender from complying with debt-collection and privacy rules.

What collectors are not allowed to do

The SEC’s prohibition on unfair debt-collection practices applies to financing and lending companies, including their third-party collection agents and service providers. Prohibited practices include:

Using or threatening violence or other criminal means to harm a borrower, the borrower’s reputation, or property
Threatening legal action that cannot lawfully be taken
Using obscene, insulting, or profane language whose natural consequence is abuse
Falsely claiming that a warrant, criminal case, court order, or government action already exists
Using false representations or deceptive collection methods
Communicating false credit or loan information, including failing to indicate that a debt is disputed when required
Publishing or disclosing a borrower’s name or personal information to shame the borrower for alleged nonpayment
Contacting people in the borrower’s phone or social-media contact list, other than properly identified guarantors or co-makers
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to limited exceptions

The time restriction has important exceptions. Contact outside those hours may be allowed when the account has been past due for more than 15 days, or when the borrower expressly agreed—through written, electronic, or recorded evidence—that those hours are the only reasonable or convenient time for contact. Even then, threats, deception, public shaming, and other abusive conduct remain prohibited.

For online lending platforms, SEC rules effective 1 August 2026 also reinforce that a person found in a borrower’s contacts cannot simply be treated as a guarantor: that person must give their own written consent. See the SEC’s official announcement on Memorandum Circular No. 20, Series of 2026.

A lender may still send accurate payment reminders, make lawful demands, negotiate payment, use authorized collection agents, report information through lawful credit-reporting channels, or file a proper civil action. Limited disclosure may also be lawful when authorized by the borrower, required by a court or government authority, or reasonably necessary for legitimate service providers, insurers, counsel, credit bureaus, or collection agents acting within the law. These exceptions do not authorize public shaming or indiscriminate messaging of contacts.

When collection becomes a privacy violation

The Data Privacy Act of 2012 requires personal information to be processed fairly, lawfully, transparently, for a legitimate purpose, and only to the extent necessary and proportionate.

Possible privacy violations include:

Copying or harvesting an entire phone, email, or social-media contact list
Messaging unrelated contacts to pressure or embarrass the borrower
Posting the borrower’s name, photograph, identification document, loan details, or fabricated “wanted” notice
Editing a borrower’s photograph into a humiliating image
Using camera, storage, microphone, or location permissions for purposes unrelated to legitimate verification or collection
Sharing loan information with an employer, relatives, neighbors, or online groups merely to shame the borrower
Continuing to retain or use unnecessary information without a lawful purpose
Using information supplied for a loan application for unrelated marketing or third-party sharing without an appropriate legal basis
Processing the personal data of someone who never borrowed, such as a phone contact or identity-theft victim

The National Privacy Commission has specifically stated that online lenders may not harvest borrowers’ phone or social-media contacts for harassment. Camera access should be limited to legitimate identity verification and must not be used to embarrass a borrower. See the NPC’s guidance on online lenders and contact-list harvesting.

Consent is not the only possible legal basis for processing data. A lender may process information necessary to evaluate or perform a loan contract, comply with law, prevent fraud, protect legitimate interests, or pursue lawful collection. But those grounds are not blanket permission to collect everything on a device or disclose information to everyone the borrower knows.

Similarly, the right to deletion is not absolute. A lender may retain records required by law, needed to establish or defend legal claims, or necessary for another valid purpose. You may nevertheless demand that unlawful or excessive processing stop and ask the lender to explain its basis for retaining the data.

Preserve evidence before blocking or deleting anything

Save evidence as soon as possible. Some messages, posts, app listings, and accounts disappear after a complaint.

Preserve:

Full screenshots showing the message, sender, telephone number or account, date, and time
Screen recordings showing the account profile, conversation, post URL, or sequence of messages
Original emails, exported chats, voice messages, call recordings lawfully made, and call logs
Links and screenshots of public posts before reporting them for removal
Messages received by relatives, co-workers, employers, or other contacts
A short written statement from each third party explaining what they received and when
The app’s name, icon, developer, app-store listing, website, privacy notice, and stated company name
Screenshots of the permissions requested or granted to the app
The loan agreement, disclosure statement, account statement, payment schedule, receipts, and collection notices
The financing or lending company’s legal name, SEC registration number, and certificate-of-authority details, if shown
Names or identifiers used by individual collectors and collection agencies
Proof of financial loss, missed work, medical treatment, or other harm, where relevant
Copies of every complaint and proof that it was delivered or received

Keep the original files and back them up. Avoid relying only on cropped or annotated screenshots; retain an unedited copy as well.

After preserving evidence, revoke unnecessary app permissions, secure your email and financial accounts, change exposed passwords or PINs, and enable multi-factor authentication. Never give a collector your one-time password, card PIN, banking password, or access to your device. Do not pay into an unverified personal account merely because someone threatens immediate arrest.

Identify the correct respondent and regulator

Problem	Where to report
Harassment or unfair collection by a financing company, lending company, online lending platform, or its collector	SEC
Excessive collection, contact-list harvesting, public disclosure, or other misuse of personal data	National Privacy Commission
Conduct by a bank, e-money issuer, or another BSP-supervised financial institution	Institution’s complaint channel first, then BSP
Threats, extortion, hacking, identity theft, impersonation, fraud, or another possible crime	Police/PNP Anti-Cybercrime Group, NBI Cybercrime Division, or CICC
Immediate threat to life or physical safety	911 or the nearest police station

The name of the app may differ from the legal entity behind it. Include both names whenever possible. A payment made through a bank or e-wallet does not necessarily make the lender BSP-supervised.

Step 1: Send a written complaint to the lender

Address the complaint to the company and, for privacy issues, its data protection officer. Use the official email or complaint channel shown in the agreement, privacy notice, app listing, or company website.

State:

Your name and reliable contact details
The app, lender, collection agency, and collector involved
The relevant account number, without publishing it publicly
A dated, factual chronology
The exact words, posts, calls, disclosures, or permissions complained of
Whether you dispute the debt, balance, interest, fees, or identity of the borrower
Which people were contacted and what information was disclosed
The action you want taken

You may request that the company:

Stop threats, public shaming, and unauthorized third-party contact
Remove unlawful posts and instruct its agents to stop distributing the material
Correct inaccurate account information
Mark the debt as disputed
Identify the legal company, collection agency, and source of your personal data
Explain the legal basis and purpose for collecting, using, retaining, or disclosing the data
Restrict, correct, block, or delete unlawfully processed data, subject to lawful retention requirements
Preserve relevant call recordings, messages, access logs, and collection instructions
Provide a written response and complaint reference number

Keep the complaint factual. Do not admit a disputed amount or make a payment promise you cannot keep merely to stop harassment.

Step 2: File an SEC complaint

Use the SEC iMessage portal, the SEC’s official ticket-based system.

According to the current iMessage user manual, select:

Financing and Lending Companies Department → Legal and Enforcement Division → Complaints on Financing and Lending Companies

Include:

The app and legal company names
SEC registration or certificate-of-authority details, if known
The collector or collection agency
Your chronology
Copies of the loan documents and payment records
Screenshots, messages, call logs, posts, and recordings
Copies of the complaint sent to the company and its response
The specific conduct you believe violates SEC collection rules

Save the iMessage ticket number and all portal acknowledgments.

Under the Financial Products and Services Consumer Protection Act, financial service providers must maintain a free consumer-assistance mechanism and are accountable for the conduct of their employees and relevant third-party service providers. Outsourcing collection does not automatically shield a lender from responsibility.

Step 3: File a privacy complaint with the NPC

First notify the respondent

As a general rule, you must first inform the lender, app operator, collection agency, or other responsible entity of the privacy issue in writing and give it an opportunity to act.

Under the NPC’s amended Rules of Procedure, you may proceed when:

The respondent fails to take timely and appropriate action; or
It does not respond within 15 calendar days after receiving your written notice.

Attach proof that the notice was received. The NPC may waive this exhaustion requirement for good cause, including a serious violation, grave or irreparable harm that only prompt NPC action can prevent, lack of another plain and adequate remedy, or patently illegal action.

The 15-day period is a pre-filing requirement in ordinary cases—not a general deadline allowing you to ignore other limitation periods.

Prepare the current complaint form

Use the NPC Complaint-Affidavit form effective 1 July 2025. Earlier forms are no longer accepted.

Complete and notarize the form, then attach:

A government-issued ID
A clear chronology
Evidence supporting each allegation
Proof of your written notice to the respondent
The respondent’s reply, if any
Documents identifying the app, lender, or collector
The relief you are requesting

The affidavit includes verification and certification concerning related proceedings. Disclose SEC, court, police, or other complaints involving the same facts when required. If you later learn of a similar proceeding, the NPC rules require prompt disclosure, generally within five calendar days.

A person who never borrowed may still file if their own personal data was collected, disclosed, or used. A representative filing for someone else generally needs a special power of attorney.

Submit the complaint

Follow the NPC’s current filing instructions. A scanned, notarized complaint may be sent to complaints@privacy.gov.ph, or submitted personally, by registered mail, or by courier to:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Barangay Paligsahan, Quezon City 1103

The basic NPC filing fee is ₱500, with a legal research fee and possible additional charges depending on the relief requested. Qualified indigent litigants may apply for an exemption with the required supporting documents. Consult the official NPC schedule of fees and obtain current payment instructions before paying.

Step 4: Use the BSP process when the creditor is BSP-supervised

If the conduct involves a bank, e-money issuer, or another BSP-supervised financial institution, first use that institution’s free consumer-assistance mechanism.

If the institution does not resolve the complaint satisfactorily, escalate through the Bangko Sentral ng Pilipinas’ consumer-assistance channels:

Use the BSP Online Buddy through the BSP consumer-assistance page; or
Send the prescribed complaint or inquiry form, together with proof of your first-level complaint, to consumeraffairs@bsp.gov.ph.

The BSP’s current complaint guide expressly directs complaints about financing companies, lending companies, online lending apps or platforms, and their collection agencies to the SEC unless the respondent is actually BSP-supervised.

Step 5: Contact law enforcement when a possible crime is involved

Seek immediate help if the collector threatens physical harm, demands money through extortion, takes over an account, impersonates you, uses stolen identification, fabricates sexual or humiliating images, or carries out another possible crime.

You may contact:

911 or the nearest police station for an immediate safety threat
The PNP Anti-Cybercrime Group or its nearest regional cybercrime unit
The NBI Cybercrime Division
The Cybercrime Investigation and Coordinating Center through hotline 1326 or report@cicc.gov.ph

The NBI may require a complaint form, sworn statement, witness statements, supporting records, and—when technically necessary—access to the affected device for examination. Its online complaint facility may also be used.

Not every rude or persistent demand is automatically a criminal offense. Criminal liability depends on the precise words, conduct, intent, evidence, and elements of the applicable law. A police or NBI complaint is separate from an SEC or NPC administrative complaint.

What reporting can—and cannot—achieve

Depending on the evidence and jurisdiction:

The SEC may investigate the lender or collector and impose appropriate administrative measures.
The NPC may investigate, facilitate settlement where appropriate, issue compliance or enforcement orders, award relief within its authority, impose administrative fines, or refer possible criminal violations to the proper authorities.
Law-enforcement agencies may investigate conduct that appears criminal and refer the case for prosecution when supported by evidence.

No agency can guarantee a favorable result merely because a complaint was filed. An app-store report, social-media takedown request, or barangay record may preserve or limit harm, but it does not replace the appropriate SEC, NPC, BSP, police, or court process.

Report promptly. Evidence can disappear, and different civil, administrative, consumer-protection, and criminal claims may have different prescriptive periods. If you receive an actual summons, subpoena, court order, or agency directive, follow the deadline stated in the document and obtain legal assistance promptly.

Common mistakes to avoid

Deleting the app or messages before preserving evidence
Posting your full loan agreement, identification card, address, account number, or private messages publicly
Complaining only to the app store or social-media platform
Naming only the app without identifying the legal company behind it
Sending a vague complaint without dates, screenshots, or specific requested relief
Paying an unverified personal account because of an arrest threat
Assuming every demand is illegal or, conversely, that every clause in the app’s terms is enforceable
Treating a phone contact as a guarantor without that person’s own valid consent
Filing inconsistent accounts with different agencies
Hiding related complaints or cases when a sworn form requires disclosure
Ignoring a real court summons because the collector previously made false threats

When legal help is urgent

Consult a lawyer promptly when:

There is a credible threat of violence or immediate physical danger
Intimate images, fabricated sexual content, or a child’s data is involved
Your bank, email, social-media, or identity credentials were compromised
You are being pursued for a loan you never obtained
A collector is using forged documents or impersonating a government officer
You receive an actual subpoena, summons, warrant, or court order
The amount, interest, penalties, or identity of the creditor is seriously disputed
You are asked to sign a waiver, quitclaim, restructuring agreement, or settlement you do not understand

Qualified applicants may seek assistance from the Public Attorney’s Office or inquire with the Integrated Bar of the Philippines about available legal-aid services.

Frequently asked questions

Can a collector contact my family, employer, or co-workers?

Not merely to shame you or pressure them into paying. Disclosure of your debt must have a lawful, necessary, and proportionate basis. A genuine guarantor or co-maker may be contacted about their own legal obligation, but a person does not become a guarantor simply because their number appeared in your phone.

Can the app post my photograph and call me a scammer?

Using your name, photograph, identification, or loan information for public shaming may violate SEC collection rules and data-privacy law. Preserve the post, account details, URL, date, and time before asking the platform to remove it.

What if I never applied for the loan?

State clearly that you dispute being the borrower. Ask the lender to preserve its application, identity-verification, device, IP, payment-disbursement, and access records. Consider complaints to the NPC and SEC and, if identity theft, forged documents, or account compromise is suspected, report the matter to law enforcement.

May I complain to both the SEC and NPC?

Yes, if the facts involve both unfair collection and unlawful personal-data processing. Each agency addresses a different legal issue. Disclose parallel proceedings where the forms or rules require it.

Do I need a lawyer?

A lawyer is not generally required to submit an SEC iMessage complaint or prepare an NPC complaint. The NPC complaint affidavit must, however, comply with its current form, evidence, verification, and notarization requirements. Legal help is valuable when the facts are disputed, the harm is serious, or court proceedings are involved.

Does filing a complaint erase the loan?

No. A valid debt remains subject to lawful collection unless it is paid, settled, cancelled, prescribed, or invalidated through an appropriate legal process. You may dispute the balance or terms while separately reporting abusive conduct.

Can I be jailed for failing to pay an online loan?

The Constitution prohibits imprisonment for debt. Ordinary inability or failure to pay a civil debt does not by itself justify imprisonment. A separate offense—such as fraud, forgery, or another crime—may still be investigated if its distinct legal elements and evidence exist. Do not ignore a genuine summons or official notice.

Can I revoke permissions and demand deletion?

You may revoke unnecessary device permissions after preserving evidence. You may also request access, correction, blocking, restriction, or deletion where legally available. The company may retain information required by law or genuinely necessary for legal claims, fraud prevention, accounting, or another lawful purpose, but it should explain that basis.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights and remedies depend on the agreement, messages, data processed, identity of the lender, and other evidence. Official sources and procedures were checked as of 6 August 2026; verify the latest forms, addresses, fees, and agency rules before filing.