Quick answer

If an online lending app is threatening, insulting, shaming, posting your information, or contacting people who are not legitimate guarantors or co-makers, preserve the evidence and report the conduct through the proper channels:

Report unfair collection practices to the Securities and Exchange Commission (SEC) through the official SEC iMessage portal.
Report unlawful collection, use, or disclosure of personal data to the National Privacy Commission (NPC). Ordinarily, you must first notify the lender or its data protection officer in writing and allow 15 calendar days from receipt for an appropriate response. The NPC may waive this requirement for serious, patently illegal, or urgently harmful violations.
Report threats, extortion, impersonation, hacking, stalking, or other possible crimes immediately to the PNP or NBI. You do not have to wait 15 days before seeking police protection or reporting a possible crime.

A complaint does not automatically erase a valid loan, stop contractual charges, or guarantee damages. It addresses the lender’s or collector’s conduct. Continue disputing incorrect balances in writing and pay only through a verified company channel.

What collectors may—and may not—do

A lender may send truthful payment reminders, request payment, offer restructuring, report credit information when authorized by law, or pursue a lawful civil remedy. Collection must nevertheless be fair, respectful, and consistent with privacy law.

The SEC’s rules prohibit lending and financing companies, their employees, agents, and third-party collectors from engaging in practices such as:

Threatening violence, property damage, reputational harm, or other criminal acts.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name or personal information merely to shame the borrower into paying.
Giving another person false loan information or failing to say that a debt is disputed.
Using false representations or deceptive methods to collect a debt or obtain information.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers.
Ordinarily contacting the borrower before 6:00 a.m. or after 10:00 p.m.

The SEC rule has a limited exception to its collection-hours provision when the account is more than 15 days past due or when the borrower gave written, electronic, or recorded express consent that those hours are the only reasonable or convenient time for contact. That exception does not legalize threats, deception, shaming, or privacy violations. See SEC Memorandum Circular No. 18, series of 2019 and the SEC’s application of the rule in this cease-and-desist order.

The broader Financial Products and Services Consumer Protection Act also prohibits abusive collection or debt-recovery practices and requires financial service providers to maintain a free consumer-assistance mechanism.

Unpaid debt is not, by itself, a crime

The Constitution provides that no person may be imprisoned merely for debt. A collector cannot truthfully claim that the police will arrest you solely because an ordinary loan is unpaid. A lender may, however, file an appropriate civil case, and separate conduct involving fraud or another alleged offense may be investigated on its own facts. See Article III, Section 20 of the 1987 Constitution.

Privacy rules for lending apps

The Data Privacy Act requires processing of personal information to be transparent, for a legitimate purpose, and proportionate to that purpose. A borrower’s consent is not a blanket license to harvest contacts, publicly shame someone, or use photographs and personal information as collection weapons.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

An app may request only data and permissions that are suitable, necessary, and not excessive for a lawful purpose.
The lender should provide clear, timely privacy information, including a “just-in-time” notice when particular data becomes necessary.
Camera or gallery access may be allowed for legitimate purposes such as identity or payment verification, but access should be turned off—or the borrower should be told it may be revoked—after that purpose is completed.
A borrower’s photograph may not be used to harass or embarrass the borrower.
Unrestrained or disproportionate processing of contact lists is prohibited, especially when it leads to harassment, unfair collection, or collection from people outside the borrower’s guarantors.
An app may use a separate interface with limited access so the borrower can select a character reference or guarantor. The lender may not treat that limited permission as authority to copy and pursue everyone in the phonebook.
A character reference may be contacted for legitimate identity or application verification. The reference must be told why the lender has the information and must be offered removal as a reference. A mere character reference is not automatically liable for the debt.
For debt collection, the NPC rule permits contact with the guarantor. A genuine co-maker may separately be contacted regarding obligations the co-maker actually assumed under the contract.
The lender remains accountable for personal data processed by an outsourced collection agency or service provider.

The amended rules allow proportionate processing of limited metadata about a contact list in appropriate circumstances. This does not permit the lender to reveal the debt to random contacts, send mass messages, or use the contact list for public humiliation.

Lawful disclosures required by a court, regulator, or credit-reporting law are different from disclosure for shaming. Whether a particular transfer is lawful depends on its purpose, legal basis, recipients, safeguards, and the documents governing the loan.

Preserve evidence before blocking or uninstalling

Do this as soon as possible:

Take uncropped screenshots showing the complete message, sender’s number or profile, date, time, URL, and surrounding conversation.
Make a screen recording of disappearing messages, posts, app permissions, privacy notices, loan disclosures, and the app-store developer page.
Export chats and emails where possible. Preserve original emails with headers, call logs, voicemail files, and recordings lawfully obtained.
Ask relatives, co-workers, references, or other recipients to retain the original messages on their own devices and give you clear copies. Record when and how they received them.
Save the loan agreement, disclosure statement, application record, payment history, receipts, account statements, and any written dispute over the balance.
Record the app’s brand name, corporate owner, developer, website, privacy-policy link, SEC registration number, Certificate of Authority number, collection agency, payment account, and every number or account used to contact you.
Prepare a chronology listing each incident, recipient, data disclosed, demand made, and response received.
Keep the original files unchanged and store backed-up copies. Do not rely only on screenshots forwarded through messaging apps, which may lose dates or other identifying information.

After preserving evidence, revoke unnecessary access to contacts, camera, photographs, files, microphone, and location. Change reused passwords and enable multi-factor authentication on email, social-media, and payment accounts. Uninstalling an app does not delete information already copied to the lender’s systems.

Do not publish the collector’s private information in retaliation. Give relevant evidence to the company, regulator, police, prosecutor, or your lawyer.

Identify the company behind the app

The app’s marketing name may be different from the corporation that owns or operates it. Check:

The privacy notice and loan agreement.
The disclosure statement.
The app-store developer details.
Payment receipts and the name of the payment recipient.
Collection emails, demand letters, and account statements.
The corporate name, SEC registration number, and Certificate of Authority displayed by the platform.

An SEC corporate registration is not, by itself, authority to operate a lending company. A lending company must also have a valid Certificate of Authority from the SEC. File a report even if you cannot identify the operator completely; provide the app name, links, numbers, payment accounts, screenshots, and other facts that may lead to its identity.

Send a written complaint to the lender

Send the complaint to the lender’s official customer-assistance channel and data protection officer, if listed. Copy the collection agency when appropriate. Use email, the app’s official support channel, or courier with proof of delivery.

Your notice should contain:

Your name and account or application reference, with only the information necessary to identify the transaction.
The dates and exact conduct complained of.
The phone numbers, profiles, or collectors involved.
The personal data used or disclosed and the people who received it.
Whether you dispute the debt, amount, fees, payment history, or identity of the creditor.
The action you want, such as stopping third-party contact, removing a public post, correcting the balance, restricting unlawful processing, or providing an account reconciliation.
A request that the company preserve call recordings, access logs, collector assignments, messages, complaint records, and disclosure records.
A request for the company’s legal name, Certificate of Authority number, data protection officer, collection agency, source of your information, and recipients of any disclosure.
A reasonable request for access, correction, blocking, erasure, or objection under privacy law, as applicable.

A deletion request is not always absolute. A lender may retain information needed to perform or establish a contract, comply with credit-reporting or other legal duties, resolve a dispute, or defend legal claims. It must still have a lawful purpose and reasonable retention period.

Keep proof that the company received your notice. The receipt date starts the ordinary 15-calendar-day period relevant to exhaustion of remedies before the NPC.

File an SEC complaint

Use the official SEC iMessage portal and select the category for lending or financing companies. Identify both the corporate lender and collection agency if known.

Attach:

Your chronology and concise factual statement.
The loan documents and account details needed to identify the transaction.
Screenshots, recordings, call logs, posts, and messages.
Statements or screenshots from third parties who were contacted.
Your written complaint to the lender and its response.
Proof of the operator’s identity, app listing, advertisements, and payment channels.
Any evidence that the operator lacks or misrepresents its Certificate of Authority.

State which conduct you are reporting—such as threats, deceptive collection, disclosure to contacts, public shaming, abusive language, or prohibited contact hours. Avoid unsupported conclusions and distinguish what you personally received from what another person reported to you.

The SEC can investigate licensing and market-conduct violations and impose appropriate administrative remedies or sanctions. Filing a complaint does not guarantee suspension of the app, cancellation of the debt, or a particular outcome.

File a formal NPC complaint

A borrower or another person whose data was processed or disclosed may complain to the NPC. This includes a relative, co-worker, friend, or phone contact whose own information was harvested or used.

Step 1: Satisfy—or explain why the NPC should waive—the prior-notice rule

Under the 2021 NPC Rules of Procedure, as amended, ordinarily you must prove that:

You informed the lender, collection agency, or other responsible entity of the privacy violation in writing; and
It failed to take timely and appropriate action or did not respond within 15 calendar days from receipt.

The NPC may waive these requirements for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy from the respondent, or patently illegal conduct. If requesting a waiver, state and prove the urgent facts. Do not merely omit the written-notice requirement.

Step 2: Complete the current complaint form

Follow the NPC’s formal complaint instructions and use the current Complaint-Affidavit form.

A formal complaint generally must be:

In writing, signed, and verified.
Notarized.
Supported by documentary evidence and witness affidavits where applicable.
Accompanied by correspondence showing prior written notice and the respondent’s action or inaction.
Accompanied by a certification against forum shopping.
Accompanied by a valid government-issued ID and other requirements stated in the current form.
Clear about the respondent, material facts, privacy violations alleged, and relief requested.

The NPC’s filing page currently permits submission in person, by courier, or by scanning and emailing the completed documents to complaints@privacy.gov.ph. Check the page immediately before filing in case its address, payment process, or submission instructions have changed.

The current published schedule lists a ₱500 base complaint filing fee, plus a legal research fee and any applicable additional fee for a damages claim. Qualifying indigent complainants may seek an exemption subject to documentary requirements. See NPC Circular No. 2023-01.

Missing evidence, verification, notarization, prior-notice proof, or the certification against forum shopping can result in dismissal. Filing an informal email alone is not necessarily the same as filing a procedurally sufficient formal complaint.

Report possible crimes immediately

Go to the nearest police station, PNP cybercrime office, or NBI office without waiting for the lender’s response when the conduct involves:

A credible threat of physical harm.
Extortion or a demand backed by threats.
Hacking or unauthorized access to an account or device.
Impersonation or use of a fabricated account.
Repeated stalking or surveillance.
Publication of altered photographs or intimate material.
A threat to harm a child, family member, workplace, or property.
An immediate risk that evidence or an account will disappear.

The NBI provides an online complaint facility and lists its Cybercrime Division. The Department of Justice also maintains official cybercrime-reporting guidance.

Bring identification, original devices when requested, backed-up evidence, witness details, the loan documents, and your chronology. Describe the acts and exact words used rather than insisting on a particular criminal charge. Whether conduct constitutes grave threats, extortion, cyber libel, unlawful data processing, or another offense depends on facts and legally required elements.

A report to the SEC or NPC does not replace a police or prosecutorial complaint when criminal investigation is needed.

If the provider is regulated by the BSP

Most independent lending and financing companies and their online platforms fall under the SEC. If the financial product was actually provided by a bank, electronic-money issuer, pawnshop, operator of a payment system, or another BSP-supervised institution:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism.
If unresolved or not acted upon within a reasonable period, escalate it through the BSP Online Buddy or BSP Consumer Assistance channels.

The BSP itself advises that complaints specifically involving financing companies, lending companies, online lending apps, and their collection agencies are generally best directed to the SEC. The regulator depends on the legal entity that actually provided the product—not merely the app used to access it.

Continue handling the loan separately

Harassment does not determine whether the principal, interest, penalties, or fees are correct. To protect yourself:

Request a complete statement of account and itemized computation.
Compare it with the signed disclosure statement, disbursement received, payments made, and contractual due dates.
Dispute incorrect amounts in writing and attach receipts.
Ask for restructuring or a payment arrangement if needed, but obtain all terms in writing.
Verify the corporate lender and payment destination before paying.
Do not send money to a collector’s personal account solely because of a threat.
Obtain an official receipt and updated balance after every payment.
Do not give a collector your password, one-time PIN, card PIN, or access to email or social-media accounts.

If the lender files a real court case, do not ignore official summons or court papers. A threatening text claiming that a case or warrant already exists is not a substitute for lawful service.

Common mistakes to avoid

Deleting messages, uninstalling the app, or closing accounts before preserving evidence.
Submitting only cropped screenshots that omit the sender, date, or conversation context.
Naming only the app brand and not identifying the corporate operator or collection agency.
Waiting 15 days despite an immediate threat to safety.
Assuming a privacy-policy checkbox legalized public shaming or mass messaging.
Assuming every unpleasant reminder is illegal harassment; preserve the exact language and circumstances.
Assuming a regulatory complaint automatically cancels the loan.
Paying an unverified person or personal e-wallet to stop threats.
Sending IDs or sensitive information to unofficial complaint pages or social-media accounts.
Publicly retaliating with the collector’s personal information.
Filing an unsigned or unnotarized NPC complaint without evidence or a certification against forum shopping.
Exaggerating the facts. Credible, chronological, well-supported reports are easier to investigate.

When legal help is urgent

Consult a Philippine lawyer promptly—or the Public Attorney’s Office if you qualify—when:

A threat appears credible or someone has approached your home, family, or workplace.
Private information or altered images are being widely published.
Money is being demanded through threats or impersonation.
Your accounts were accessed or loans were opened without your consent.
Several companies or collectors are involved.
You need an injunction, damages, or urgent preservation of electronic evidence.
You received actual court, prosecutor, SEC, NPC, or police documents.
The debt computation, loan validity, or identity of the creditor is materially disputed.
You are near a filing deadline or significant evidence may soon be deleted.

Frequently asked questions

Can a lender contact my relatives or employer?

Not merely to embarrass you or pressure them into paying. Random phone contacts, relatives, co-workers, and employers generally may not be used for debt collection unless a person has a legally relevant role, such as an actual guarantor or co-maker. A character reference may be contacted for legitimate application verification but is not automatically liable for the loan.

Does agreeing to app permissions allow the lender to message everyone?

No. Permission and consent must be tied to a lawful, specific, and proportionate purpose. The amended NPC rules allow limited processing in defined circumstances, including limited access that lets a borrower select a reference or guarantor. They do not allow unrestrained copying, mass messaging, harassment, or public shaming.

Can the lender post my name, photo, ID, or loan details online?

Ordinarily, publication to shame a borrower is prohibited. A lawful disclosure to a court, regulator, authorized credit system, or properly engaged service provider is different and must still satisfy applicable law. The purpose, recipient, legal basis, and safeguards matter.

Can I complain even if I really owe the money?

Yes. A lender may collect a valid debt, but it must use lawful methods. Your complaint can address threats, deception, abusive language, public disclosure, or contact-list misuse without denying a legitimate balance.

Can I complain if I am only a person in the borrower’s contacts?

Yes, if your own contact information or other personal data was collected, used, or disclosed unlawfully. Preserve the message you received and identify how the collector connected you to the borrower.

Should I uninstall the lending app?

Preserve evidence first, then revoke unnecessary permissions. You may uninstall the app if needed for safety or security, but uninstalling does not erase information already transferred to the lender or collection agency. Submit an appropriate written access, restriction, correction, or deletion request separately.

Will filing a complaint stop all collection calls immediately?

Not necessarily. Regulators evaluate evidence and follow their procedures. Ask the lender in writing to stop unlawful conduct and to communicate through a specified lawful channel. Report immediate threats to law enforcement without waiting for regulatory action.

Can I be arrested because I missed a loan payment?

Not solely for ordinary unpaid debt. The Constitution prohibits imprisonment for debt. Separate alleged criminal conduct may still be investigated, and a lender may pursue lawful civil remedies.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The applicable remedy depends on the loan documents, parties, communications, evidence, and surrounding facts. Laws, procedures, fees, and official filing channels were checked against primary government sources as of August 1, 2026.