Quick answer

Report unfair debt collection to the Securities and Exchange Commission (SEC) and privacy violations—such as harvesting contacts, public shaming, or disclosing loan information—to the National Privacy Commission (NPC). Threats, fraud, scams, or unauthorized account access should also be reported promptly to cybercrime authorities.

Before deleting the app or blocking its collectors, preserve the evidence. For an NPC complaint, normally notify the lender or its data protection officer in writing first. If it does not take appropriate action or respond within 15 calendar days, you may file a formal complaint. The NPC may waive this step for good cause or a serious violation involving a risk of grave or irreparable harm.

A complaint does not automatically cancel a valid loan, stop lawful collection, or erase legitimate principal, interest, or charges. It challenges the collector’s methods and use of personal data. The SEC itself states that it cannot cancel the obligation, rewrite payment terms, declare the contract void, or rule that an interest rate is excessive through its administrative complaint process.

What conduct can be reported?

A lender or collection agency may send reasonable payment reminders, demand payment, negotiate a settlement, report accurate information through legally authorized channels, or pursue a lawful court action. It may not collect through intimidation, deception, public humiliation, or unlawful use of personal data.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices include:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Disclosing or publishing the names or other personal information of borrowers who allegedly refuse to pay, except where disclosure is legally allowed.
Giving or threatening to give another person loan information known—or which should be known—to be false, including failing to say that the debt is disputed.
Using false representations or deceptive means to collect a debt or obtain information about the borrower.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been past due for more than 15 days or the borrower expressly agreed, through written, electronic, or recorded means, that those are the only reasonable times for contact. Even when this timing exception applies, threats, insults, deception, shaming, and privacy violations remain prohibited.
Contacting people taken from the borrower’s contact list who did not separately agree to be guarantors.

The Financial Products and Services Consumer Protection Act also prohibits financial service providers from using abusive collection or debt-recovery practices and requires fair treatment, data protection, and an accessible consumer-assistance mechanism.

When collection becomes a privacy violation

The Data Privacy Act of 2012 requires personal data to be processed transparently, for a legitimate purpose, and only to an extent proportionate to that purpose. Agreeing to a privacy notice or granting an app permission is not blanket permission to harass, shame, or indiscriminately message other people.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, and the government’s March 2026 joint advisory on online lending platforms:

An app cannot require unnecessary permissions involving personal or sensitive personal information.
Contact-list processing cannot be unbridled, excessive, or disproportionate.
Contact data cannot be used to harass the borrower or collect from people who are not guarantors.
A character reference is not automatically a guarantor.
A guarantor must separately and expressly consent to assume responsibility if the borrower defaults.
For debt collection, the lender may contact a guarantor—not unrelated contacts or a character reference who never consented as guarantor.
A character reference must be told that the borrower supplied the reference’s details, how those details were obtained, and how the reference may request removal.
Character-reference details cannot be used for unrelated marketing, cross-selling, or sharing with third parties.
Once an app permission is no longer needed, the app should prompt the user to disable or revoke it.
Personal data may be kept only as long as needed for the stated purpose, legal claims, or another lawful retention requirement, after which it must be securely disposed of.

Possible privacy violations include:

Messaging relatives, officemates, employers, neighbors, or unrelated phone contacts about the debt.
Posting the borrower’s name, photograph, identification document, contact details, or alleged debt in a group chat or on social media.
Creating a “wanted,” “scammer,” or similar shaming post using the borrower’s information.
Accessing contacts, photos, location, files, or social-media information beyond what is necessary and disclosed.
Continuing to use a character reference’s information after a valid removal request, unless another lawful ground justifies retention.
Falsely telling other people that they are guarantors or jointly liable.
Using a borrower’s or contact person’s data for threats, impersonation, or another undisclosed purpose.

Whether a particular disclosure is unlawful depends on the data disclosed, the recipient, the declared purpose, the person’s consent, and any legal basis the lender can prove.

What to do immediately

1. Preserve the evidence before changing the app

Save evidence in its original form where possible:

Screenshots showing the complete message, sender’s number or account, date, and time.
Full chat exports, emails with headers, voicemails, call logs, and text messages.
The app’s name, icon, version, developer, download-page URL, privacy notice, and permissions.
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and collection agency, if shown.
Loan agreement, disclosure statement, repayment schedule, receipts, payment confirmations, and account history.
Copies of posts, group chats, or messages sent to third parties, including the URL and names of recipients.
Short signed statements from contacts who received collection messages, together with copies of what they received.
Your written dispute or demand and proof of delivery.
A chronological incident log identifying each collector, number used, statement made, recipient contacted, and resulting harm.

Keep an untouched backup in cloud storage or another device. Do not crop away identifying details. If a post may disappear, capture both the content and its profile or URL.

Preserve existing voicemails or recordings sent to you. Do not secretly record a private telephone conversation without first obtaining legal advice about the Anti-Wiretapping Act.

2. Secure the phone and accounts

After documenting the app and its permissions:

Revoke access to contacts, photos, camera, microphone, location, files, and other resources that are no longer necessary.
Change passwords if there is reason to believe an account was compromised.
Enable multi-factor authentication and review active sessions.
Never give a collector an OTP, PIN, password, card security code, or remote access to your device.
Remove the app after preserving evidence if keeping it installed presents a security risk.
Warn affected contacts not to click links, install apps, send money, or provide information to the collector.

Revoking consent or uninstalling the app does not necessarily require deletion of records the lender must lawfully retain for an existing contract or legal claim. It does prevent reliance on consent for unnecessary processing and supports a request to stop excessive access.

3. Send a written complaint to the lender

Use the lender’s official consumer-assistance channel and data protection officer address shown in its app, privacy notice, contract, or website. State:

Your name and account or application reference, without sending passwords or OTPs.
The dates and details of the harassment or disclosure.
The numbers, agents, collection company, and recipients involved.
Which information was accessed, disclosed, or used.
Whether you dispute the debt, amount, payment status, or identity of the borrower.
The action you want: stop abusive contact, stop contacting non-guarantors, remove public posts, correct inaccurate data, restrict unlawful processing, identify recipients and data sources, preserve relevant logs, and investigate the collector.
That you require a written response.

Ask for a ticket number and keep proof that the company received the complaint. This written notice is important for the NPC’s exhaustion-of-remedies requirement.

If continuing disclosure creates grave or irreparable harm, do not simply wait while the damage spreads. Preserve evidence, seek urgent legal assistance, and explain in the NPC filing why immediate intervention and waiver of the usual 15-day requirement are necessary.

How to report unfair collection to the SEC

The SEC regulates lending and financing companies and their recorded online lending platforms.

Go to the official SEC iMessage portal.
Sign in through or create an eSECURE account.
Select Financing and Lending Companies Department and then Complaints on Financing and Lending Companies.
Identify both the app name and its operating company. Include the collection agency if known.
Attach the supporting evidence, a valid government-issued ID, and any current complaint form required by the portal.
Create the ticket and save its reference number. Monitor the ticket because the SEC may request clarification or additional documents.

The government’s March 2026 advisory also lists the SEC hotline 1-4732 (1-4SEC). The SEC iMessage user guide confirms that iMessage is the SEC’s central platform for complaints and ticket tracking.

Submit a separate complaint for each respondent company when more than one lender is involved. The SEC’s published complaint procedure states that the company is generally furnished a copy and given 10 days from receipt to answer or comment. Sufficient evidence may lead to a formal administrative action; filing alone does not guarantee sanctions or a particular result.

How to file a privacy complaint with the NPC

First satisfy—or explain why the NPC should waive—the 15-day requirement

Under the 2021 NPC Rules of Procedure, as amended, a complainant normally must prove that:

The lender, collector, or other responsible entity was notified of the privacy violation in writing; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice.

The NPC may waive these requirements for proven good cause or a serious violation involving risk of harm, including grave and irreparable damage that only NPC action can prevent or mitigate, absence of a plain and adequate remedy from the respondent, or patently illegal action.

Complete the current complaint documents

Download the NPC’s current Complaint-Affidavit form. It includes a Filipino translation and a questionnaire covering possible Data Privacy Act violations.

A formal complaint should include:

The identities and contact details of the complainant and respondent, or facts that may help identify an unknown respondent.
A clear chronological narration.
The personal data involved and how it was collected, accessed, used, or disclosed.
The relief requested.
All correspondence with the respondent and proof of its response or non-response.
Documentary evidence and relevant witness affidavits.
Verification and certification against forum shopping.
A valid government-issued ID.

The form must be signed and notarized. A representative generally needs a special power of attorney. Parents representing a minor may attach the child’s birth certificate; a court-appointed guardian should attach the relevant court order.

Pay the assessed fee and file

NPC Circular No. 2023-01 sets a ₱500 base complaint filing fee, plus a legal research fee equal to 1% of the filing fee but not less than ₱10. Claims for damages carry additional graduated fees. Obtain the NPC’s assessment and use only its official payment instructions.

The same Circular provides a fee exemption for qualifying indigent litigants whose family gross income does not exceed twice the applicable monthly minimum wage and who do not own real property with a fair market value above ₱300,000. Supporting documents include a barangay certificate of indigency and the required notarized affidavits and tax declaration, if any.

Submit the notarized complaint and attachments:

In person or by courier to the National Privacy Commission, 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103; or
As a clear scanned submission to complaints@privacy.gov.ph, following the NPC’s current PDF and document instructions.

Keep the originals, delivery receipt, sent email, acknowledgment, payment record, and case number. The NPC’s formal complaint page and contact page contain updated filing and assistance information.

The NPC’s published procedure gives its Complaints and Investigation Division 30 calendar days from receipt to give due course to the complaint or dismiss it without prejudice. Its website estimates approximately 10 to 12 months through final adjudication, although actual duration depends on the case.

When a temporary ban may be necessary

If personal data is still being distributed and ordinary processing may not prevent serious harm, ask a lawyer or the NPC about an Application for Temporary Ban on Processing Personal Data. It may be filed with the complaint or before the NPC decision becomes final. It requires supporting evidence, additional procedural documents, and ordinarily a bond unless the applicant is exempt. A request is not automatically granted.

Where to report threats, fraud, or cybercrime

An SEC or NPC complaint does not replace a criminal report. If collectors threaten physical harm, impersonate officers, demand payment through suspicious accounts, access accounts without authority, or engage in fraud, report promptly to law enforcement.

The official March 2026 joint advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

For an immediate threat to life or safety, call 911 or go to the nearest police station. Tell a trusted person where you are, avoid meeting a collector alone, and preserve the threatening messages.

The specific criminal offense, proper venue, and required evidence depend on the exact words, publication, access method, and identity of the sender. A police report or blotter may document the incident, but it does not by itself replace any complaint required before a prosecutor, court, SEC, or NPC.

If the lender is a bank or another BSP-supervised institution

Complaints against ordinary SEC-registered lending and financing companies belong primarily with the SEC. If the loan provider is instead a bank, electronic-money issuer, pawnshop, or another institution supervised by the Bangko Sentral ng Pilipinas, complain first through that institution’s consumer-assistance mechanism.

If unresolved, escalate through the BSP Online Buddy and Consumer Assistance Mechanism or email the prescribed form to consumeraffairs@bsp.gov.ph with proof of your earlier complaint to the institution. The BSP itself directs complaints about financing companies, lending companies, online lending apps, and their collection agencies to the SEC.

Common mistakes that weaken a complaint

Deleting the app, messages, or posts before preserving complete evidence.
Submitting cropped screenshots with no sender, date, time, URL, or context.
Naming only the app brand and not its corporate operator or collection agency.
Failing to notify the respondent in writing before an NPC complaint without explaining a valid ground for waiver.
Filing an unsigned or unnotarized NPC form, omitting the certification against forum shopping, or failing to attach evidence.
Combining several unrelated respondent companies in one SEC complaint.
Ignoring requests for additional documents or failing to monitor the case email and ticket.
Exaggerating what was said or claiming that every payment reminder is harassment.
Paying through a collector’s personal account without verifying that the instruction came from the legitimate lender.
Giving an alleged investigator, collector, or “fixer” an OTP, PIN, password, or unnecessary copy of an identity document.
Assuming that reporting harassment automatically cancels the debt or permits all payments to stop.

Continue paying any undisputed amount through a verified official channel when appropriate, or request a written restructuring arrangement. If you dispute the balance, state the dispute clearly and request an itemized account rather than making admissions about figures you have not verified.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly when:

There is a credible threat of violence, arrest, seizure, or harm to property.
Intimate images, identity documents, medical information, or other sensitive data have been exposed.
The collector is contacting an employer, clients, or a large group and the disclosure is continuing.
Someone used your identity to obtain a loan.
You received a summons, subpoena, formal demand, or court pleading.
The lender claims you signed as guarantor or co-maker but you dispute the signature or consent.
You want damages, an injunction, a temporary ban, or criminal prosecution.
Several agencies or cases may involve the same issues, making the certification against forum shopping important.
A legal deadline may be approaching.

Different administrative, civil, and criminal remedies have different prescriptive periods. Do not delay merely because an app promises to “investigate.”

Frequently asked questions

Can a lender contact my family, employer, or officemates?

Not merely because their details appeared in your phone. For debt collection, current NPC rules allow contact with a person who separately and expressly consented to be a guarantor. A character reference is not automatically a guarantor. Contacting other people to shame or pressure you may violate both SEC collection rules and privacy law.

What if I gave the app permission to access my contacts?

Permission does not authorize harassment, public shaming, disproportionate processing, or debt-collection messages to non-guarantors. The scope and validity of consent, the privacy notice, the necessity of access, and how the data was actually used still matter.

May an app access any part of my contact list?

Only limited and proportionate processing for a specified lawful purpose may be allowed—for example, enabling you to select a character reference or guarantor, or deriving proportionate metadata when necessary. Unrestricted harvesting and use of contacts for collection or harassment are prohibited.

Can a character reference be made to pay?

Not solely because the borrower named that person as a reference. A guarantor must expressly bind himself or herself to answer for the obligation and must give separate consent. Whether a particular signed agreement created liability requires review of the document and surrounding facts.

Can a contact person file a complaint even if they are not the borrower?

Yes, if the lender processed that person’s own phone number, name, messages, or other personal data unlawfully. The contact person should preserve what was received and file based on the violation affecting their own data.

Does harassment erase the loan?

No. Unlawful collection conduct and the underlying debt are separate issues. The lender may still pursue a valid obligation through lawful means. The amount, interest, fees, payments, identity of the borrower, and enforceability of the documents may be disputed separately.

What if I never applied for the loan?

Dispute it immediately in writing, request the application and identity-verification records, secure your accounts, and do not pay without verification. Report suspected identity theft, unauthorized access, or fraud to the lender, SEC or BSP as applicable, NPC, and cybercrime authorities.

Should I block the collector?

Preserve complete evidence first. You may then block abusive numbers for safety, but keep an official written channel open for legitimate account notices and agency communications.

Can the SEC or NPC guarantee that the app will be removed or that I will receive damages?

No. The agencies evaluate jurisdiction, evidence, defenses, and applicable law. Possible outcomes depend on the facts and may include dismissal, corrective orders, administrative sanctions, suspension or revocation of authority, or other relief allowed by law. Filing does not guarantee any particular result.

Official legal and procedural sources

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Application of the law depends on the loan documents, consent records, messages, parties, and other evidence. Official sources and filing information were checked on 1 August 2026.