Quick answer

If an online lending app threatens, insults, publicly shames, impersonates authorities, or uses your contacts, photos, or other personal data to pressure payment, take these steps:

Preserve the evidence and secure your phone.
Send a written complaint to the lender and its data protection officer.
Report unfair collection practices to the Securities and Exchange Commission (SEC).
File a privacy complaint with the National Privacy Commission (NPC) when personal data was misused.
Report threats, extortion, fraud, identity theft, or immediate danger to law enforcement.

A valid debt may still be collected through lawful means, but default does not authorize harassment or waive your privacy rights. The financial service provider also cannot automatically escape responsibility by blaming its collection agency or other authorized representative. Under the Financial Products and Services Consumer Protection Act, providers are responsible for their representatives and may be solidarily liable with accredited third-party service providers.

What counts as reportable conduct?

Unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits lending and financing companies—and their collectors—from practices such as:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening arrest, prosecution, seizure, or another action that cannot legally be taken.
Using obscenities, insults, or abusive language.
Publishing or disclosing a borrower’s name or personal information to shame the borrower, except for narrowly permitted lawful disclosures.
Giving third parties false loan information or failing to say that a debt is disputed.
Using false representations or deceptive means to obtain payment or information.
Contacting people in the borrower’s contact list who are not named guarantors or co-makers.
Contacting the borrower at unreasonable hours.

The circular generally treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable. It states exceptions where the account has been past due for more than 15 days or the borrower expressly agreed, through written, electronic, or recorded means, that those hours are the only convenient time. Those exceptions do not permit threats, insults, deception, or public shaming. The prohibited practices are reproduced in an official SEC cease-and-desist order.

A truthful warning that the lender may pursue a legally available civil remedy is not automatically harassment. False claims—such as saying that a collector has already issued a warrant, that the police will arrest the borrower immediately, or that nonpayment alone is a crime—are different. Article III, Section 20 of the 1987 Constitution prohibits imprisonment for debt. Separate conduct involving fraud or another criminal offense may still be prosecuted on its own facts.

Privacy violations involving contacts, photos, and other data

The Data Privacy Act of 2012, NPC Circular No. 20-01, and its 2022 amendments require loan-related data processing to be transparent, lawful, necessary, and proportionate.

Under the amended rules:

An app cannot demand unnecessary permissions or process more information than reasonably needed.
Access to a camera or photo gallery should be limited to a legitimate purpose such as identity verification and should end when that purpose is complete.
A borrower’s photo cannot be used to harass or embarrass the borrower.
Unconstrained or excessive processing of phone, email, or social-media contact lists is prohibited.
An app may use limited contact-list access to let the borrower select references or guarantors, or to derive proportionate metadata for a specified legitimate purpose. It cannot freely copy and use the entire list for collection.
A character reference may be contacted to verify the borrower’s identity or the truth of application information—not to collect the debt, market products, or shame the borrower.
A character reference is not automatically a guarantor.
A guarantor must separately and expressly consent to that role.
For privacy purposes, debt-collection contact is limited to an actual guarantor. Random contacts, relatives, friends, coworkers, and character references cannot be contacted merely because their numbers appeared on the borrower’s phone.

These rules were reiterated in the government’s 18 March 2026 advisory on online lending platforms. A general “allow contacts” permission or privacy-policy checkbox does not legalize harassment.

A genuine co-maker may have direct contractual obligations, but that depends on what the person knowingly signed. Merely listing someone’s name or telephone number does not make that person a guarantor or co-maker.

What to do immediately

1. Deal with any safety risk first

If a threat appears credible or someone is on the way to your home or workplace, move to a safe place and call 911, the nationwide emergency hotline. Tell security personnel, household members, or your employer only what they need to know for safety.

Do not meet a collector alone or surrender your phone, identification, ATM card, SIM, or account credentials.

2. Preserve evidence before it disappears

If it is safe, save:

Screenshots showing the complete message, sender, date, and time.
Original text messages, emails, chat threads, and voice messages.
Call logs and contemporaneous notes stating what was said.
Screenshots and URLs of public posts, comments, group messages, or altered photographs.
Messages received by relatives, coworkers, references, or other contacts.
The app’s name, icon, download page, developer name, version, and requested permissions.
The lender’s corporate name, SEC registration number, Certificate of Authority number, address, privacy notice, and data protection officer details.
The loan agreement, disclosure statement, repayment schedule, statement of account, payment receipts, and any settlement proposal.
Proof that the amount or account was disputed.
Copies of your written complaints and delivery or read receipts.

Keep original files whenever possible. Do not crop away the sender, timestamp, URL, or account identifier. Back up the evidence somewhere the app cannot access.

Be careful about secretly recording telephone conversations. The Anti-Wiretapping Act generally requires authorization from all parties to a private communication, and the Supreme Court has applied the rule even to a participant who secretly recorded a private conversation. Preserve call logs, voicemail left for you, written messages, and detailed notes instead, unless a lawyer or investigator advises that recording is lawful in the circumstances.

3. Secure the phone and accounts

After preserving what you safely can:

Revoke the app’s access to contacts, camera, photos, microphone, location, storage, SMS, and call logs.
Change passwords that were reused elsewhere.
Enable multifactor authentication on email, social media, banking, and e-wallet accounts.
Review financial accounts for unauthorized activity.
Warn affected contacts not to click links, disclose information, or send money.
Remove the app after preserving the contract, payment history, privacy notice, and other evidence.

Revoking permission or uninstalling the app may stop future device access, but it does not erase data the operator already copied.

Send the lender a written notice

Use the official customer-service and data-protection contacts shown in the contract, app, or privacy notice. Avoid links or payment instructions sent by an unverified collector.

Your notice should identify:

Your name and account or loan reference number.
The app and the legal company operating it.
Each incident, with dates, numbers, usernames, and affected contacts.
The personal data used or disclosed.
Whether you dispute the debt, amount, interest, fees, payments, or identity of the creditor.
The action you want.

Request, as applicable:

Immediate cessation of threats, abusive messages, public posts, and third-party contact.
Removal of unlawful posts and correction of false statements.
Identification of the company, collector, collection agency, and source of the personal data.
A complete statement of account and copy of the loan documents.
Restriction, blocking, correction, or deletion of unlawfully processed data.
Preservation of relevant collection records, call logs, instructions, and access records.
A written response and complaint reference number.

Deletion is not absolute. A lender may retain information required by law or reasonably necessary to establish, exercise, or defend legal claims. It must still stop unauthorized or disproportionate processing.

Where to report

Problem	Main authority	Important first step
Unfair collection by a lending or financing company or its collector	SEC	Preserve evidence; an internal complaint is useful but does not prevent prompt SEC reporting
Misuse or disclosure of contacts, photos, loan information, or other personal data	NPC	Generally notify the company in writing and allow up to 15 calendar days for action
Complaint against a bank or another BSP-supervised institution	BSP	Complain first through the institution’s consumer assistance mechanism
Threats, extortion, fraud, impersonation, identity theft, or immediate danger	PNP, NBI, DICT/CICC, or 911	Report promptly; do not wait for the regulatory complaint to finish

Reporting to one agency does not automatically file a case with the others. The same incident may properly be reported to more than one authority because each has a different mandate.

SEC: unfair debt collection and unauthorized lending operations

For a lending company, financing company, online lending platform, or its collection agency:

Go to the SEC iMessage ticketing system.
Open a new ticket.
Select “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.
Identify both the app and its corporate operator.
Attach the evidence, loan documents, affected telephone numbers, and requested action.
Save the ticket number and monitor the ticket.

The SEC’s current public advisory also lists hotline 1-4732 (1-4SEC). The SEC iMessage user guide explains account creation, ticket filing, document submission, and status tracking.

Report the app even if it appears unregistered or uses a changing name. State that you could not verify its Certificate of Authority or corporate identity and attach the app-store page, advertisements, payment instructions, and communications.

NPC: misuse of personal data

A borrower may complain to the NPC when personal data was unlawfully collected, accessed, used, retained, or disclosed. A relative, coworker, reference, or other contacted person may also file a complaint about the misuse of their own personal data.

The 15-calendar-day rule

Under the 2021 NPC Rules of Procedure, as amended, the complainant generally must:

Inform the company or other concerned entity in writing about the privacy violation; and
Show that it failed to take timely and appropriate action or did not respond within 15 calendar days after receiving the notice.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, no plain and adequate remedy, or patently illegal conduct. Explain and prove why immediate NPC action is necessary if relying on an exception.

How to file

Use the current complaint-affidavit available on the NPC’s formal complaint page. The form must be completed accurately and notarized. Attach:

A valid government-issued ID.
A chronological narration.
Documentary and witness evidence.
The written notice sent to the company and its response, if any.
The identity and available contact details of the respondent.
The relief requested.
The required certification against forum shopping.

The complaint may be filed in person, by courier, or by sending a scanned copy to complaints@privacy.gov.ph, following the NPC’s current instructions.

The current fee schedule lists a ₱500 filing fee, plus a legal research fee of 1% of the filing fee but not less than ₱10. Additional fees may apply to damages claims or requests for interim relief. Qualified indigent complainants may seek exemption by submitting the required proof under the NPC schedule of fees.

If you later learn that the same or a similar claim has been filed in another court, tribunal, or quasi-judicial agency, the NPC rules require disclosure within five calendar days.

BSP: when the lender is BSP-supervised

Most complaints about independent financing and lending companies belong with the SEC. Use the BSP process if the actual creditor is a bank or another BSP-supervised institution.

First file a formal complaint through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. If its action or response is unsatisfactory, escalate through the BSP Online Buddy (BOB) on the BSP website or official BSP Facebook page.

If BOB is unavailable, submit the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph, with proof of the complaint filed with the institution. The BSP complaint guide explains the current process.

Do not include PINs, passwords, full card numbers, or unnecessary identification documents in a BSP complaint.

Police and cybercrime authorities

Report immediately when the communications involve credible threats, extortion, impersonation, fraudulent payment instructions, account takeover, identity misuse, stalking, or other possible crimes.

Current official channels include:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
DICT Cyber Hotline: 1326@dict.gov.ph
Immediate danger: 911

These channels are included in the government’s 2026 online-lending advisory. Bring original evidence, identification, a written timeline, and information identifying the app, company, collector, telephone numbers, accounts, and payment channels.

Reporting the app to Google Play, Apple’s App Store, a social-media platform, or a telecommunications provider can help remove harmful content or accounts, but it does not replace an SEC, NPC, BSP, or law-enforcement complaint.

What happens to the loan?

Harassment does not automatically cancel a valid loan. Continue to separate two issues:

The debt: whether the loan exists, the amount is correct, and interest, charges, and payments were properly computed.
The collection conduct: whether the lender or collector violated consumer-protection, privacy, or criminal laws.

Ask for a complete statement of account and dispute errors in writing. Pay only through a verified company channel and obtain a receipt. Do not send money to a collector’s personal bank or e-wallet account merely because the collector threatens immediate arrest or publication.

If you receive genuine court papers, do not ignore them. Regulatory complaints do not automatically suspend a court deadline.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Reporting only the app’s brand name without identifying its corporate operator.
Sending original evidence without keeping copies.
Posting your contract, identification, contact list, or other sensitive data publicly while asking for help.
Secretly recording calls without considering the Anti-Wiretapping Act.
Paying an unverified account to make threats stop.
Assuming a contact-list permission authorizes the lender to message everyone.
Assuming payment automatically prevents an investigation of past violations.
Waiting for an SEC or NPC response while a credible safety threat is developing.
Ignoring real summonses, subpoenas, or formal notices because the collector previously sent fake ones.

When legal help is urgent

Seek help from a lawyer, the Public Attorney’s Office if qualified, or another accredited legal-aid provider promptly when:

There is a credible threat of physical or sexual violence.
Private photos, identification documents, or sensitive information have been published or threatened with publication.
A collector is demanding money in exchange for deleting posts or not contacting others.
Someone used your identity or financial account.
The harassment

Quick answer

If an online lending app is threatening you, shaming you, contacting unrelated people, or misusing your personal data, take these steps:

Preserve the evidence and secure your phone.
Send a written complaint to the lender and its data protection officer.
Report unfair collection practices to the Securities and Exchange Commission (SEC).
File a privacy complaint with the National Privacy Commission (NPC) when personal data was improperly accessed, used, or disclosed.
Report threats, fraud, extortion, impersonation, or other possible crimes to the PNP, NBI, or DICT cyber hotline. Call 911 if anyone is in immediate danger.
If the lender is a bank or another BSP-supervised institution, complain to the institution first, then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).

A real unpaid loan does not give a lender permission to threaten, insult, publicly shame, or indiscriminately contact your relatives, coworkers, and phone contacts. At the same time, harassment does not automatically cancel a valid debt. Deal with the collection abuse and the legitimate account balance as separate issues.

What online lenders and collectors are not allowed to do

SEC Memorandum Circular No. 18, Series of 2019 prohibits lending and financing companies—and their collectors—from using unfair debt-collection practices. Prohibited conduct includes:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language to abuse the borrower.
Publishing or disclosing borrowers’ names and personal information, except through narrowly permitted and lawful disclosures.
Giving other people false loan information or concealing that a debt is disputed.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting people in the borrower’s contact list who were not named guarantors or co-makers—even if the borrower supposedly consented to contact access.
Contacting the borrower at unreasonable hours.

The circular generally defines unreasonable contact as communication before 6:00 a.m. or after 10:00 p.m. It states exceptions when the account is more than 15 days past due or the borrower expressly agreed, through written, electronic, or recorded means, that those are the only reasonable contact times. These exceptions do not authorize threats, insults, deception, or public shaming. The prohibited practices are reproduced in an official SEC cease-and-desist order.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, separately protects consumers’ rights to fair treatment, data privacy, disclosure, and timely complaint handling. It expressly prohibits abusive debt collection. A financial service provider remains responsible for its employees and agents and may be solidarily liable with accredited third-party service providers involved in debt collection. See the Financial Products and Services Consumer Protection Act.

Privacy violations commonly committed by lending apps

The Data Privacy Act and NPC rules require personal data processing to be transparent, lawful, legitimate, and proportionate. A loan application does not create unlimited consent to access or use everything on a borrower’s phone.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

An app may require only permissions that are suitable, necessary, and not excessive for a legitimate stage of the loan process.
Camera or photo access used for identity verification should be disabled when that purpose has been completed.
A borrower’s photograph cannot be used to embarrass or harass the borrower.
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited.
Contact-list access must be limited to legitimate purposes, such as allowing the borrower to choose a character reference or guarantor, or deriving proportionate metadata when legally justified.
Character references may be contacted to verify the applicant’s identity or information—not to collect the debt, market products, or pressure the borrower.
A character reference is not automatically a guarantor.
A guarantor must separately and expressly consent to be bound.
For debt collection under the NPC rules, the lender may contact the guarantor, not random contacts or mere character references.
Data cannot be kept indefinitely merely because it might be useful someday.

The DICT, NPC, and SEC reaffirmed these rules in their March 18, 2026 joint advisory on online lending platforms.

Examples of reportable privacy conduct include:

Copying or uploading an entire contact list and using it for collection.
Messaging relatives, coworkers, neighbors, or social-media contacts about the debt.
Posting the borrower’s name, photograph, ID, address, loan balance, or alleged delinquency online.
Making “wanted,” “scammer,” “estafa,” or funeral-style images using the borrower’s photograph.
Accessing photos, location, messages, files, or accounts beyond what was necessary and disclosed.
Continuing to process data after permission is no longer necessary, without another lawful basis.
Refusing to identify the company, collector, data source, or purpose of processing.
Treating a person as a guarantor although that person never agreed to guarantee the loan.

Whether a particular act violates the Data Privacy Act still depends on what data was processed, who processed it, the stated purpose, the available lawful basis, and the evidence. The relevant statute is the Data Privacy Act of 2012.

Preserve evidence before it disappears

If there is no immediate safety risk, preserve the evidence before blocking numbers, deleting messages, or uninstalling the app. If the app appears to be compromising your device or accounts, secure the device first.

Keep:

Screenshots showing the entire message, sender, number or username, date, and time.
Original SMS, chat, email, voicemail, and call-log entries.
URLs, account names, profile identifiers, and screenshots of public posts.
The app-store listing, developer name, app version, and requested permissions.
The privacy notice, consent screens, loan contract, disclosure statement, promissory note, and collection policy.
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and collection-agency details.
Proof of disbursement, payments, receipts, and the lender’s statement of account.
Messages received by relatives, coworkers, employers, or character references.
A chronological incident log identifying what happened, when, through which account or number, and who witnessed it.
Copies of all complaints, delivery receipts, automated acknowledgments, ticket numbers, and replies.

Ask contacted persons to preserve the original messages on their own devices and provide a signed statement if necessary. Do not crop away identifying information, edit files, or add annotations to the only copy. Keep an untouched backup.

Be cautious about secretly recording calls. Republic Act No. 4200 generally prohibits secretly recording a private communication without authorization from all parties, including when the recorder is a participant. Preserve call logs, voicemails, written messages, and contemporaneous notes instead, unless a lawyer or investigating officer advises that a specific recording is lawful. See the Anti-Wiretapping Act and Ramirez v. Court of Appeals.

Secure your phone and accounts

After preserving what is reasonably available:

Revoke unnecessary access to contacts, photos, camera, microphone, location, storage, call logs, and SMS through the phone’s settings.
Change passwords for email, social media, banking, and e-wallet accounts if the app or collector may have obtained them.
Use unique passwords and enable multi-factor authentication.
Review active sessions, recovery details, connected devices, and recent transactions.
Contact your bank, e-wallet provider, or mobile network immediately if there are unauthorized transactions, a SIM takeover, or account access.
Remove the app after preserving the contract, account records, privacy notice, permissions, and other evidence.

Revoking a permission or uninstalling the app stops some future device access, but it does not erase data already copied to the lender’s systems.

Send the lender a written complaint

Write to the lender’s official customer-service channel and data protection officer. Avoid relying only on a phone call. Your notice should state:

Your name and account or loan reference number.
The app’s name and the lender’s corporate name.
The collector’s name, number, email address, or account.
A chronological description of the conduct.
The personal data accessed, used, or disclosed.
The people contacted and what they were told.
Whether you dispute the debt, balance, fees, due date, or identity of the creditor.
The specific relief you want.
A request that the lender preserve all relevant records.

You may demand that the lender:

Stop threats, insults, public posts, and third-party collection messages.
Instruct its collection agency and agents to stop the prohibited conduct.
Identify the legal entity operating the app and every authorized collector involved.
Explain the source, purpose, lawful basis, recipients, and retention period for your data.
Correct inaccurate information.
Block, erase, or securely dispose of data that has no lawful basis or is no longer necessary, subject to lawful retention and legal-claim requirements.
Remove a person who was incorrectly listed as a character reference or guarantor.
Provide a complete statement of account and legitimate payment channel.
Confirm its action in writing.

Save proof that the notice was received. This is particularly important for an NPC complaint.

Report to the correct authority

Different agencies address different parts of the problem. A report to one agency does not automatically create a case with the others.

Problem	Primary channel	Important first step
Unfair collection by a lending or financing company or its collector	SEC Financing and Lending Companies Department	Preserve evidence; an internal complaint is useful, but ongoing abuse may be reported promptly
Improper access, use, retention, or disclosure of personal data	National Privacy Commission	Generally notify the lender or concerned entity in writing and allow 15 calendar days for action
Complaint against a bank or another BSP-supervised institution	Provider’s FCPAM, then BSP Consumer Assistance Mechanism	Complain to the supervised institution first
Threats, extortion, fraud, impersonation, identity theft, or other suspected crime	PNP, NBI, or DICT/CICC	Report promptly; use 911 for immediate danger

File an SEC complaint

For most online lending and financing companies, submit a ticket through the SEC iMessage system:

Open a new ticket and sign in through eSECURE.
Select “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.
Identify both the app and the corporate operator.
Describe each prohibited act by date and attach organized evidence.
Include the loan documents, collector information, people contacted, and your written complaint to the lender.
Save the electronic ticket number and monitor its status.

The SEC’s March 2026 advisory also lists 1-4732 (1-4SEC) for assistance. The current SEC iMessage user guide explains ticket creation and tracking.

Report the app even if it appears unregistered or hides its operator. State what you know and attach the app-store page, website, payment instructions, receiving account, messages, and advertisements. An SEC complaint addresses regulatory violations; it is not a substitute for an immediate police report when threats or fraud are involved.

File an NPC privacy complaint

A formal NPC complaint is appropriate when you—or another affected person—experienced unauthorized or excessive data processing. A relative, coworker, character reference, or other contacted person may have a separate complaint if their own personal data was misused.

Under the 2021 NPC Rules of Procedure, as amended, the general exhaustion rule requires proof that:

You informed the lender, collector, or concerned entity in writing about the privacy violation; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving the notice.

The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of a plain and adequate remedy, or patently illegal conduct. Explain and prove why a waiver is necessary; do not simply omit the prior notice.

Use the current complaint-affidavit linked from the NPC’s formal complaint page. The complaint generally must be:

Written, signed, verified, and notarized.
Supported by a valid government-issued ID.
Accompanied by the relevant messages, screenshots, records, witness affidavits, and correspondence with the respondent.
Clear about the respondent’s identity—or the available facts that may identify it.
Accompanied by the required certification against forum shopping.
Clear about the relief being requested.

Submit it in person, by courier, or by scanning and emailing it to complaints@privacy.gov.ph, following the NPC’s current instructions. The NPC fee schedule lists a ₱500 filing fee, plus a legal research fee of 1% of the filing fee but not less than ₱10. Additional fees or bonds may apply to damages claims or interim relief. Qualified indigent complainants may seek exemption by submitting the required supporting documents. Check the current NPC schedule of fees before paying, and pay only through an official NPC channel.

If you later learn that the same or a similar claim has been filed elsewhere, the certification rules require reporting that fact to the NPC within five calendar days.

Escalate a BSP-supervised lender complaint

Use the BSP process only when the actual lender is a bank or another BSP-supervised institution. An e-wallet used to disburse or receive payment is not necessarily the lender.

First complain through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. Keep its reference number and response. If the complaint remains unresolved or the response is unsatisfactory, escalate it through the BSP Online Buddy on the BSP website or submit the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph.

The BSP explains the current process in its guide to filing a complaint against a BSP-supervised institution and consumer-assistance page.

Do not send PINs, passwords, full card details, passbooks, or copies of unnecessary IDs. The BSP states that these are not required to process a BSP-CAM complaint.

Report threats, fraud, and other possible crimes

Do not wait for the SEC or NPC process if there is a credible threat of violence, stalking, sexual violence, extortion, account takeover, identity theft, or a crime in progress. Call 911 or go to the nearest police station.

For cyber-related reports, the March 2026 government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

Provide the original messages, numbers, account identifiers, URLs, transaction records, incident chronology, and regulatory complaint numbers if already available. Let investigators determine the appropriate criminal classification; threats, coercion, online libel, identity theft, unauthorized data processing, and other offenses have different legal elements.

Continue addressing any legitimate loan safely

Ask for a written statement of account showing the principal, interest, fees, penalties, payments, and total claimed balance. If you dispute the amount, identify the exact entries in writing.

Pay only through a channel verified in the contract or directly confirmed through the lender’s official website or customer-service system. Be cautious if a collector suddenly instructs you to send money to a personal bank account, unfamiliar e-wallet, cryptocurrency wallet, or different corporate name.

If you need restructuring or more time, make a written proposal you can realistically follow. Do not admit an amount you have not verified, sign blank documents, provide OTPs, or borrow from another abusive app merely to stop the messages.

Simple nonpayment of a civil debt is not, by itself, a ground for imprisonment. Article III, Section 20 of the 1987 Constitution prohibits imprisonment for debt. That rule does not prevent a creditor from filing a lawful civil case, and it does not shield separate criminal conduct such as fraud. A collector may truthfully state that lawful remedies are being considered, but cannot invent warrants, court cases, arrests, or government authority.

Common mistakes to avoid

Deleting the app, messages, or social-media posts before preserving them.
Filing against only the app’s brand name without identifying the corporate operator.
Submitting hundreds of unsorted screenshots without an incident chronology.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Posting unredacted IDs, loan documents, phone numbers, or relatives’ information while asking for help online.
Treating a character reference as if that person automatically guaranteed the loan.
Assuming that clicking “allow contacts” legalized public shaming or indiscriminate collection messages.
Paying an unverified collector to make threats or posts disappear.
Waiting for a regulator while a credible physical threat or account takeover is ongoing.
Ignoring authentic court papers. If you receive a summons, subpoena, or court order, verify it directly with the issuing court and obtain legal help immediately.

When legal help is urgent

Consult a lawyer, the Public Attorney’s Office if you qualify, or another recognized legal-aid provider promptly when:

The collector threatens physical or sexual violence, kidnapping, stalking, or harm to family.
Private photographs, IDs, medical information, or intimate material were posted or threatened with release.
The app used your identity to create accounts, loans, posts, or documents.
Money was taken from a bank or e-wallet account without authorization.
Harassment has spread to your employer, clients, school, or a large number of contacts.
The lender denies operating the app or the payment recipient cannot be identified.
You want damages, an injunction, or urgent NPC interim relief.
You receive real court papers or a demand involving a large or disputed amount.
The same facts may be the subject of several cases, making forum-shopping and procedural rules relevant.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. Unconstrained contact-list processing and contacting random contacts for debt collection are prohibited. A properly consenting guarantor may be contacted. SEC rules also refer to a genuine named co-maker, who may be directly obligated under the signed contract. A person does not become a guarantor or co-maker merely because the borrower entered that person’s name or number.

Can the lender contact my character reference about payment?

A character reference may be contacted to verify the applicant’s identity or the truth of application information. NPC rules prohibit using the character reference for debt collection, marketing, cross-selling, or unrelated disclosures. The person must be told how the lender obtained the contact details and must be given the option to have the data removed as a character reference.

Is posting my name and photograph legal if the debt is real?

Not merely because the debt is real. Public shaming and unnecessary disclosure of loan and identity information can violate SEC collection rules and the Data Privacy Act. Lawful disclosures—such as authorized credit reporting, compliance with a court or government order, or necessary disclosure to an authorized collection agent—are different from posting accusations publicly.

Do I have to wait 15 days before reporting?

The 15-calendar-day rule generally applies before the NPC gives due course to a formal privacy complaint. It does not prevent an immediate SEC report or police report. The NPC may also waive exhaustion for serious cases when the required grounds are properly alleged and proven.

Does revoking app permissions erase information already collected?

No. It may stop future device access, but previously copied data may remain in the lender’s or processor’s systems. Ask the company to disclose what it holds and to erase, block, or securely dispose of data that is unlawfully processed or no longer necessary. Erasure is not absolute where retention is required by law or genuinely necessary for legal claims.

Can I complain even after paying the loan?

Yes. Payment does not automatically erase a past privacy violation or unfair collection practice. Preserve proof of payment and state clearly that the complaint concerns the collection conduct or data use.

Should I report the app to Google, Apple, or a social-media platform?

Yes, when appropriate, but platform reporting is supplementary. It does not replace a complaint to the SEC, NPC, BSP, or law-enforcement authorities.

What if I never borrowed but the app is contacting me?

Preserve the messages and notify the company in writing that you are not the borrower, guarantor, or co-maker. Ask where it obtained your data and demand that collection contact stop. You may file your own NPC complaint because the personal data being processed is yours.

Official legal and procedural sources

This article provides general legal information, not advice for a particular case. The proper regulator, remedies, deadlines, and possible offenses depend on the lender’s identity, the contract, the exact communications, and the available evidence. Laws, agency forms, fees, addresses, and filing channels were checked against official sources as of July 30, 2026.