Quick answer

An online lender may demand payment through lawful, reasonable collection methods. It may not threaten, shame, deceive, insult, expose your debt to unrelated people, misuse your contacts or photos, or use excessive personal data to pressure you.

Report unfair collection by a lending or financing company to the Securities and Exchange Commission (SEC). Report misuse of contacts, photos, IDs, location, messages, or other personal data to the National Privacy Commission (NPC). If there are credible threats, extortion, stalking, account takeover, impersonation, or defamatory online posts, also report promptly to the police or the NBI Cybercrime Division.

These complaints serve different purposes and may be filed in parallel when the facts overlap. Filing a complaint does not automatically erase a valid debt, stop interest, or suspend an agreed due date.

What conduct can be reported?

The Financial Products and Services Consumer Protection Act prohibits financial service providers from using abusive collection or debt-recovery practices and protects consumers’ rights to fair treatment, data privacy, and complaint redress.

For SEC-regulated lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by the company and its collectors or third-party service providers. Report conduct such as:

Threatening violence, property damage, reputational harm, or another criminal act.
Threatening arrest, imprisonment, seizure, or legal action that the collector cannot lawfully take.
Using obscene, profane, insulting, or abusive language.
Pretending to be a lawyer, police officer, court employee, government agent, or another person with authority.
Giving false information about the debt or using deceptive means to obtain payment.
Posting or circulating the borrower’s name, photograph, ID, loan information, or supposed refusal to pay to shame the borrower.
Contacting people in the borrower’s phonebook who were not named as guarantors or co-makers.
Repeated communications whose frequency, tone, or method amounts to intimidation or harassment.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m. SEC MC No. 18 contains exceptions where the account is more than 15 days past due or the borrower expressly agreed that those hours are the only reasonable or convenient opportunities for contact. Even then, threats, deception, public shaming, abusive language, and other abusive conduct remain prohibited.

A genuine demand letter, accurate statement of account, civil collection case, or respectful payment reminder is not automatically harassment. The legality depends on what was said or disclosed, who was contacted, how often, when, and for what purpose.

When app permissions become a privacy violation

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate. Consent is not a blanket license to process every file or contact on a phone.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

Loan apps must not demand unnecessary or excessive permissions.
Access to protected phone resources must be suitable, necessary, and proportionate to a legitimate purpose.
Consent should be obtained when the particular information becomes necessary, with a just-in-time notice explaining its use.
Camera or gallery access may be justified at a particular stage for identity verification, fraud prevention, or payment verification, but it should not remain open without a continuing lawful reason.
A borrower’s photograph must never be used to harass or embarrass the borrower.
Unrestrained or excessive processing of contact lists is prohibited, especially when it leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors.
An app may provide a limited interface allowing the borrower to select a character reference or guarantor. This does not justify copying or using the entire contact list for collection.
A character reference may be contacted to verify the applicant’s identity or the truth of application information. A character reference is not automatically a guarantor and must be offered a way to have their information removed as a reference.
A guarantor must separately consent to that legal role. For debt collection, the lender may not treat ordinary phone contacts or character references as guarantors.
Data must not be kept indefinitely merely because the lender might find another use for it later.

These privacy rules apply even when the lender or operator lacks the required SEC authority. They also cover service providers processing data for the lender.

What to do immediately

1. Protect yourself if there is an urgent threat

Call 911 or go to the nearest police station if a message contains a credible or imminent threat of physical harm. Do not wait for an SEC or NPC administrative complaint to be processed.

Seek prompt law-enforcement help when the collector:

Publishes your home address or live location while threatening you.
Threatens to harm you, your children, or another person.
Demands money using threats unrelated to lawful debt collection.
Creates sexualized, obscene, or defamatory edited images.
Impersonates you, accesses your accounts, or uses your identity for transactions.
Continues stalking or approaching your home or workplace after explicit threats.

Whether particular conduct constitutes grave threats, coercion, cyberlibel, identity theft, extortion, or another offense depends on the exact words, acts, intent, and evidence. Let investigators or a lawyer assess the proper charge.

2. Preserve evidence before blocking or uninstalling

Save evidence in its original form whenever possible:

Full screenshots showing the sender’s number or profile, date, time, and complete message.
Screen recordings that show the conversation from the account or app itself.
Call logs, lawful voicemails, emails, demand letters, and chat exports.
URLs and screenshots of social-media posts, including the profile name and publication time.
The app’s store listing, developer name, package or app ID, version, privacy notice, and requested permissions.
The loan agreement, disclosure statement, repayment schedule, statement of account, receipts, and payment history.
The collector’s name, company, numbers used, payment instructions, and claimed authority.
Messages sent to relatives, colleagues, employers, or other contacts. Ask each recipient to preserve the original and write down when it was received.
Proof of harm, such as workplace notices, medical records, account-security alerts, or expenses, where relevant.

Create a dated chronology and keep at least two backups. Do not crop away identifying details or edit the original files. Give regulators unredacted evidence when necessary, but redact IDs, addresses, account numbers, and children’s information from anything shared publicly.

Do not secretly record private calls without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties.

3. Secure your phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, camera, microphone, location, photos, files, SMS, and other permissions that are no longer necessary.
Check for unfamiliar apps, device-administrator privileges, accessibility access, and active login sessions.
Change compromised passwords using a trusted device and enable multi-factor authentication.
Inform your bank or e-wallet immediately if credentials, OTPs, or financial accounts may have been exposed.
Block abusive numbers after saving the evidence, while retaining one official written channel if you are requesting records or negotiating payment.
Uninstall the app if it presents a security risk, but only after documenting its details and preserving the records you need.

Reporting the app to Google Play, Apple’s App Store, a social-media service, or a telecommunications provider may help stop further abuse, but it does not replace filing with the appropriate government agency.

Send a written notice to the lender

Before filing a formal NPC complaint, the general rule is that you must first inform the lender, its data protection officer, or the concerned entity in writing and give it an opportunity to act.

Send the notice through a verifiable official channel and keep proof of delivery. Include:

Your name, account or application reference, and secure contact details.
The app name and the lender’s legal corporate name, if known.
A short dated account of the harassment or privacy violation.
The numbers, accounts, collectors, or service providers involved.
The specific third parties contacted and information disclosed.
A demand to stop abusive communications and contact with non-guarantors.
A request to identify the source, purpose, recipients, and lawful basis for processing your data.
A request for access, correction, blocking, removal, or deletion where legally warranted.
A request to preserve relevant records and provide a complete statement of account.
The action you want the company to take.

Erasure is not absolute. A lender may retain information that remains necessary for a lawful contract, regulatory duty, legal claim, or another valid purpose. It must still limit the data to what is necessary, protect it, and stop unauthorized uses.

Under the NPC Rules of Procedure, as amended, the company generally has 15 calendar days from receipt of your written notice to respond or take timely and appropriate action. The NPC may waive this exhaustion requirement for good cause or serious cases, including grave and irreparable harm, lack of an adequate remedy from the respondent, or patently illegal conduct. Explain and prove the urgency if you request a waiver.

How to report the lender to the SEC

Use the official SEC iMessage portal. Select:

Financing and Lending Companies Department → Monitoring and Compliance Division → Complaints on Financing and Lending Companies

The SEC iMessage user guide explains how to create and track a ticket. Retain the ticket number and upload a clearly labeled evidence file.

Your complaint should identify both the app and the company behind it. An app’s brand name may differ from the lender’s registered corporate name. Include, if available:

App name, website, store URL, and developer.
Lender’s corporate name, SEC registration number, and Certificate of Authority details.
Loan account or application reference.
Collector or collection-agency details.
A chronological statement of the prohibited conduct.
Screenshots, call logs, posts, contracts, receipts, and third-party messages.
Your earlier complaint to the company and its response.
The relief requested, such as investigation, cessation of harassment, correction of records, or other action within SEC authority.

State if the lender appears unregistered, uses an undisclosed app, demands payment through a personal account, or refuses to identify the company responsible. Follow any SEC instruction requiring a verified complaint or additional documents; opening a ticket may be only the start of a formal enforcement or adjudication process.

How to file a privacy complaint with the NPC

Use the NPC’s current formal complaint page and download the Complaints-Assisted Form.

A formal complaint should generally be:

In writing, signed, verified, and notarized.
Filed by the affected data subject or an authorized representative. A representative normally needs a special power of attorney.
Directed against an identified person or entity, or supported by facts that can lead to identification.
Accompanied by a clear narration, supporting evidence, requested relief, and correspondence with the respondent.
Supported by proof that the respondent was given an opportunity to address the matter, unless a waiver is justified.

The NPC currently permits filing personally, by registered mail, courier, or authorized electronic mail. Its complaint page directs electronic submissions to complaints@privacy.gov.ph. Follow the current formatting, signature, copy, and payment instructions displayed when you file.

Under NPC Circular No. 2023-01, the basic complaint filing fee is ₱500, with additional scheduled fees for claims for damages. The Rules provide exceptions for government complainants and indigent complainants, and allow the NPC to waive the fee for good cause upon motion.

The complaint may be dismissed without prejudice if it lacks the required form, evidence, identifiable parties, prior written notice, or facts showing a privacy violation. Organize attachments by date and explain exactly which data was collected, how it was used, who received it, and why the use was unnecessary or unauthorized.

A non-borrower may also complain if the app processed that person’s own contact details or other personal data and caused a privacy violation. For example, a relative or colleague whose number was taken from a borrower’s phone and used for collection is also a data subject.

When to report to the BSP instead

If the provider is a bank, digital bank, e-money issuer, pawnshop, operator of a payment system, or another BSP-supervised institution, first complain through the institution’s Financial Consumer Protection Assistance Mechanism. If the response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism or BSP Online Buddy.

The BSP is not the principal regulator of an ordinary SEC-licensed lending or financing company. When the business model or responsible company is unclear, verify the institution through the BSP Verifier and provide the same evidence to the SEC if the entity claims to be a lending or financing company.

When to involve the NBI or police

For suspected cybercrime or other criminal conduct, use the NBI online complaint page, contact the NBI Cybercrime Division, or go to the nearest NBI or police office. Bring:

A government-issued ID.
The device containing the original evidence, if safe to do so.
Printed and electronic copies of the chronology and key messages.
URLs, account identifiers, telephone numbers, and transaction records.
Witness details and copies of any SEC or NPC complaint already filed.

Administrative complaints and criminal investigations are separate. The SEC or NPC may regulate the company and its data processing, while law enforcement investigates possible offenses by particular individuals.

Common mistakes that weaken a complaint

Uninstalling the app or deleting conversations before preserving evidence.
Naming only the app and not trying to identify the corporate lender or collector.
Submitting isolated screenshots without dates, sender details, or surrounding context.
Filing an NPC complaint without proof of the written notice and 15-day period, while failing to explain why waiver is justified.
Posting IDs, loan documents, phone numbers, or intimate images publicly while asking for help.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Replying with threats, profanity, false accusations, or promises you cannot keep.
Paying a collector’s personal account without verifying that it is an authorized payment channel.
Assuming that an SEC, NPC, police, or app-store report automatically cancels the debt.
Ignoring official notices, court papers, or regulator requests because a harassment complaint is pending.

If the debt is valid

You may challenge abusive collection while responsibly addressing the account. Ask the lender for:

A complete statement of account.
The principal, interest, fees, penalties, payments, and current balance.
The loan agreement and disclosure statement.
Written proof that the collector is authorized.
A written restructuring or payment proposal, if available.
Official payment instructions and an official receipt.

Do not pay merely because someone threatens arrest or public humiliation. Verify the creditor, amount, and payment channel first. At the same time, do not falsely deny a debt that records show is valid.

The Constitution states that no person may be imprisoned for debt alone. A lender may pursue lawful civil remedies, and separate criminal liability may arise from distinct conduct supported by evidence; non-payment by itself is not a lawful basis for a collector to order an arrest. See Article III, Section 20 of the 1987 Constitution.

When legal help is urgent

Consult a lawyer promptly when:

Threats are credible, repeated, or directed at children or family members.
Private or intimate material has been posted or threatened with publication.
The lender has filed a case or you received a subpoena, summons, or prosecutor’s notice.
Your identity, accounts, or electronic signatures were used without authority.
You are being blamed for a loan you did not obtain.
A purported guaranty or co-maker agreement contains a signature you dispute.
You need urgent interim relief to stop continuing publication or data processing.
The incident has caused substantial financial, medical, employment, or reputational harm.

The Public Attorney’s Office, an Integrated Bar of the Philippines legal-aid office, a law-school legal clinic, or private counsel may help assess available administrative, civil, and criminal remedies. Eligibility and available services vary.

Frequently asked questions

Can a loan app contact my family, friends, or employer?

Not merely because their numbers appear in your phone. Contacting non-guarantors to collect, shame, or pressure the borrower is prohibited. A limited identity-verification inquiry to a properly selected character reference is different, but a character reference is not automatically liable for the loan and may not be used as a collection target.

Does clicking “Allow contacts” make text blasts legal?

No. Permission or consent does not legalize unnecessary, excessive, misleading, or harassing processing. The lender must still establish a lawful purpose and comply with transparency and proportionality requirements.

Can the lender contact a guarantor or co-maker?

A person who genuinely and separately agreed to be a guarantor or co-maker may be contacted concerning that obligation. The lender should be able to produce the agreement. Simply appearing in a contact list or being named as a character reference is insufficient.

Can I file with both the SEC and NPC?

Yes. An incident may involve both unfair collection and unlawful processing of personal data. Each agency addresses matters within its own authority.

Must I wait 15 days before going to the police?

No. The 15-calendar-day rule concerns the ordinary exhaustion requirement for an NPC privacy complaint. Report credible threats, ongoing crimes, or immediate safety risks to law enforcement without delay.

What if I am not the borrower?

You may still complain about the processing of your own data. Tell the company in writing that you are not the borrower or guarantor, request the source and purpose of the processing, demand that collection contact stop, and preserve every message.

Will a complaint erase the loan?

No. Harassment and privacy violations do not automatically extinguish a lawful obligation. The debt’s validity, amount, and enforceability are separate issues.

Is there a deadline for reporting?

File promptly while evidence, accounts, and witnesses remain available. Different administrative, civil, and criminal claims may have different prescriptive periods. The clear procedural period for an ordinary NPC complaint is the respondent’s 15 calendar days to act after receiving your written notice; urgent cases may justify waiver. Obtain legal advice rather than waiting if a possible filing deadline is approaching.

Official references and filing channels

This article provides general legal information, not legal advice or a prediction of how an agency or court will decide a particular case. Rules, forms, fees, office arrangements, and filing channels can change; confirm them on the linked official pages before filing. Sources were checked as of August 6, 2026.