Quick answer

If an online lending app threatens, insults, repeatedly harasses, publicly shames, or improperly contacts people in your phone, preserve the evidence and report the conduct to the proper regulator:

Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission (SEC).
Report misuse, excessive collection, or unauthorized disclosure of personal data to the National Privacy Commission (NPC).
If the lender is a bank, e-wallet provider, or another institution supervised by the Bangko Sentral, complain first to the institution and then escalate the matter to the Bangko Sentral ng Pilipinas (BSP).
Report credible threats of violence, extortion, impersonation, account intrusion, or other possible crimes promptly to law enforcement.

You may report the harassment even if you genuinely owe money. A valid debt does not authorize abuse or public shaming. At the same time, filing a complaint does not automatically erase, suspend, or settle the loan.

What conduct may be unlawful?

Creditors may make reasonable, lawful efforts to collect an overdue loan. They may send proper payment reminders, explain the balance, propose a payment arrangement, or pursue a legitimate civil claim.

The line may be crossed when a lender, collector, employee, or third-party collection agency does any of the following:

uses threats, violence, insults, obscene language, or other abusive methods;
threatens an action that cannot legally be taken or that the collector does not intend to take;
falsely represents that the collector is a police officer, lawyer, court employee, or government official;
uses deceptive means to collect the debt or obtain information about the borrower;
tells the borrower’s employer, co-workers, relatives, friends, social-media contacts, or other unrelated people about the debt merely to embarrass or pressure the borrower;
publishes the borrower’s name, photograph, loan details, identification document, or accusations on social media or in group chats;
alters a photograph or creates a “wanted,” “scammer,” or similar poster to shame the borrower;
harvests or copies the borrower’s phone, email, or social-media contact lists for collection or harassment;
uses a selfie or identity-verification photograph for humiliation rather than its legitimate verification purpose;
contacts a person listed only as a character reference to demand payment from that person or to pressure the borrower;
continues using personal data in a way that is unnecessary, excessive, or unrelated to a lawful and declared purpose; or
conceals the collector’s identity or refuses to identify the lending or financing company for which the collector acts.

These restrictions apply not only to the lender’s employees. Under SEC Memorandum Circular No. 18, Series of 2019, regulated lending and financing companies can be responsible for collection activities performed through third-party service providers. The Financial Products and Services Consumer Protection Act also prohibits abusive collection or debt-recovery practices by covered financial service providers and makes providers responsible for relevant acts or omissions of their representatives.

Whether particular conduct is legally actionable will depend on the exact messages, the collector’s purpose, who received the information, the loan documents, the privacy notice, and the lender’s regulatory status.

Privacy rules for lending apps

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality. Consent is not the only possible lawful basis, but a lender cannot treat access to a phone as unlimited permission to collect and use everything stored in it.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, an online lender must limit app permissions and personal-data processing to purposes that are suitable, necessary, and not excessive for the transaction. Access to a camera may be justified for identity verification, for example, but the resulting photograph cannot lawfully be repurposed for harassment or public shaming.

An app should not harvest phone, email, or social-media contact lists for debt collection. A person identified merely as a character reference is not automatically a co-borrower or guarantor. The rules for an actual guarantor may differ because the guarantor’s contractual obligation and the documents signed must be examined.

Deleting the app or withdrawing consent also does not necessarily require the lender to erase every record immediately. Some information may lawfully be retained to perform the loan contract, comply with recordkeeping duties, establish or defend legal claims, or meet another lawful purpose. Data that is inaccurate, unlawfully obtained, excessive, or no longer necessary may be subject to correction, blocking, or erasure, depending on the facts.

Preserve evidence before blocking or deleting anything

Do this as soon as possible:

Capture the complete communication. Take screenshots showing the message, sender’s number or account, date, time, and surrounding conversation. For disappearing messages, make a screen recording if it can be done safely.
Save the original files. Export chats and emails where possible. Keep voicemail, call recordings lawfully made or received, photographs, posts, URLs, notification logs, and call histories. Do not rely only on cropped screenshots.
Document third-party contacts. Ask relatives, co-workers, employers, or friends who received messages to preserve the original messages and provide screenshots showing the sender, date, and time. Record what personal or loan information was disclosed to each person.
Identify the responsible business. Save the app-store page, app name, developer name, website, privacy notice, terms and conditions, company name, collection-agency name, email addresses, phone numbers, payment instructions, and collector’s claimed identity.
Keep the loan records. Preserve the disclosure statement, promissory note, repayment schedule, proof of disbursement, receipts, account ledger, notices, and any payment proposal or dispute.
Record app permissions. Screenshot the permissions requested or granted, including access to contacts, camera, photographs, location, microphone, SMS, storage, or social-media information.
Create a short chronology. List each incident by date, time, sender, recipient, communication method, words or conduct used, and evidence filename.

Keep an unedited copy of every item. If you annotate or redact evidence for sharing, retain the original separately. Avoid posting your complete loan records or identification documents publicly.

Ask the lender to stop and correct the violation

Send a written complaint to the lender’s official customer-assistance channel and, if available, its data protection officer. Keep proof of delivery.

State:

your name and loan or account reference;
the app and company involved;
the dates and specific acts complained of;
the phone numbers, accounts, or collectors involved;
the people who were contacted and what was disclosed;
the personal data that appears to have been accessed or used;
the action you want, such as stopping third-party contact, removing a public post, correcting inaccurate data, restricting unlawful processing, identifying the collection agency, or giving you a copy of relevant account information; and
a request for a written response and preservation of collection logs, access logs, recordings, and instructions given to collectors.

Use neutral, factual language. Do not admit a disputed balance simply to make the harassment stop. If you acknowledge the loan, distinguish that from any dispute over interest, charges, payments, identity, or collection conduct.

Writing to the respondent is particularly important for an NPC complaint because the NPC generally requires exhaustion of remedies: the complainant should first inform the personal information controller, processor, or concerned entity in writing and allow it to act. If contacting the respondent was impossible or unsafe, explain and document the reason. The NPC may waive requirements only where its rules permit; do not assume that urgency automatically excuses them.

File a complaint with the SEC

The SEC regulates lending companies and financing companies, including their reported online lending platforms. First verify the company’s identity and authority through the SEC’s Check with SEC portal and official lists. An app’s brand name may differ from the corporation operating it.

For a formal complaint:

Download and complete the SEC complaint form.
Prepare one complaint form for each respondent company.
Attach a copy of a valid government-issued ID.
Attach the loan documents and evidence of harassment or unfair collection.
Submit through a filing method stated on the SEC’s current complaints page for lending and financing companies or open a ticket through SEC iMessage.

The SEC advises complainants to complete the form accurately and attach supporting evidence; an insufficient complaint may be dismissed. If filing by email under the SEC’s published instructions, follow its prescribed subject-line format.

The SEC may seek the company’s answer and determine whether administrative proceedings are warranted. It may also refer privacy matters to the NPC or other agencies. The SEC expressly states that this complaint process cannot itself rewrite the loan, declare the interest void, cancel the debt, or settle the obligation.

If the operator appears unregistered or lacks authority to conduct lending business, say so expressly in the complaint and attach the app-store listing, advertisements, payment instructions, and other evidence linking the app to its operator.

File a privacy complaint with the NPC

A borrower whose information was misused may complain to the NPC. A person from the borrower’s contact list may also have an independent complaint if the lender collected, used, or disclosed that person’s own data without a lawful basis.

Use the NPC’s current complaint-affidavit form and instructions on its formal complaint page. The NPC presently instructs complainants to:

download and complete the prescribed form;
clearly identify the complainant and respondent;
list the personal information processed;
narrate the facts in chronological order;
identify the privacy violations and relief requested;
attach correspondence showing prior written notice to the respondent—or explain why no prior contact was made;
attach all supporting evidence;
complete the verification and certification against forum shopping;
have the complaint notarized; and
submit it in person, by courier, or by scanned email using the address and email stated on the NPC’s current filing page.

The NPC’s form warns that failure to attach supporting evidence may result in outright dismissal. Evidence must also comply with applicable procedural requirements, including the Rules on Electronic Evidence.

Possible issues may include unauthorized processing, processing for an unauthorized purpose, malicious disclosure, unauthorized disclosure, violation of data-subject rights, or failure to observe the general data-privacy principles. Identify the facts rather than guessing at a criminal provision; the NPC will determine the proper legal characterization.

The NPC’s procedure is governed by its 2021 Rules of Procedure, as amended by NPC Circular No. 2024-01. Check the filing page immediately before submission because forms, fees, addresses, and procedural instructions can change.

If the lender is regulated by the BSP

Some digital loans are offered by banks or other BSP-supervised financial institutions rather than SEC-regulated lending companies. In that situation:

complain first through the institution’s consumer-assistance mechanism;
obtain a reference number and keep its final response, if any; and
if the matter remains unresolved, escalate it through the BSP Consumer Assistance Mechanism.

The BSP currently provides its Online Buddy channel and an alternative complaint form and email route on that page. Submit the complaint, the institution’s response, account records, and harassment or privacy evidence.

Regulatory routes can overlap. A complaint about a BSP-supervised provider may also raise a distinct privacy issue within the NPC’s jurisdiction.

When to contact law enforcement urgently

Seek immediate police or emergency assistance if a collector makes a credible threat of physical harm, is approaching your home or workplace aggressively, demands money through extortion, unlawfully accesses an account or device, impersonates an official, or distributes intimate images.

Possible criminal liability depends on the exact acts and evidence. Harassing conduct may implicate the Revised Penal Code, the Data Privacy Act, the Cybercrime Prevention Act, or another law, but not every offensive collection message satisfies every element of a crime.

Bring or preserve:

the original device;
complete messages and headers;
phone numbers, usernames, profile links, and payment accounts;
dates and times;
witness details;
proof linking the sender to the lender; and
copies of reports already made to the app platform, lender, SEC, NPC, or BSP.

The Department of Justice maintains an official guide for reporting cybercrime incidents. Depending on the incident, reports may also be made to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. For an immediate danger, contact the local police or the national emergency hotline rather than waiting for an administrative complaint.

Protect your accounts and reduce further exposure

After preserving evidence:

review and revoke unnecessary app permissions;
change passwords for email, banking, e-wallet, and social-media accounts if compromise is suspected;
enable multi-factor authentication;
sign out unknown devices and review account activity;
report abusive posts or accounts to the relevant platform, while retaining proof of the post and report;
ask recipients not to forward the disclosure further;
inform your employer’s HR or security team if workplace contact or an in-person visit is threatened; and
monitor financial accounts and identity records for suspicious activity.

Uninstalling the app may stop local access but will not erase data already copied to the lender’s systems. Send a separate written request addressing unlawful or unnecessary processing.

Common mistakes to avoid

Deleting messages too soon

Blocking a collector may be sensible for safety, but first preserve complete evidence. A cropped screenshot without the sender, date, or context may be difficult to authenticate.

Reporting only the app’s marketing name

Identify the corporation, collection agency, developer, payment recipient, and individual collector where possible. Attach evidence connecting each one to the incident.

Treating every collection attempt as harassment

A respectful and proportionate payment reminder is not automatically unlawful. Focus on threats, deception, excessive contact, third-party disclosure, public shaming, unauthorized access, or other specific conduct.

Assuming app consent permits everything

Permission to access a feature does not by itself make every later use lawful. Processing must still have a lawful basis and remain transparent, necessary, and proportionate.

Assuming the complaint cancels the debt

Harassment and loan liability are separate questions. Continue requesting a correct statement of account and address payment arrangements or disputed charges in writing.

Paying an unfamiliar account under pressure

Confirm the creditor and official payment channel. Preserve any demand instructing payment to a personal bank or e-wallet account, especially if the operator’s identity is unclear.

Filing an unsupported or exaggerated complaint

State only what you can honestly describe and support. Separate facts you personally witnessed from information supplied by another person, and identify the source of each item.

When legal help is urgent

Consult a Philippine lawyer promptly when:

the lender has filed or threatened an identifiable court case and you received actual summons, a subpoena, or another official document;
intimate images, identification documents, or sensitive personal information were published;
threats involve physical harm, stalking, extortion, or workplace confrontation;
the loan was taken through identity theft or an account takeover;
substantial money or multiple lenders are involved;
you need an injunction, damages, or another court remedy;
you are unsure whether signing a restructuring agreement would waive or alter a defense; or
a regulator has dismissed the complaint or issued an order with a deadline for reconsideration, appeal, or compliance.

Do not ignore genuine court papers. Verify them through the issuing court or with counsel; a collector’s text message saying that a case has been filed is not itself a summons.

Frequently asked questions

Can a lender contact my family, friends, or employer?

Not simply to shame you or broadcast your debt. Limited contact may be defensible for a legitimate and proportionate purpose, such as locating a borrower when lawful, but disclosing loan details or pressuring unrelated contacts can violate collection and privacy rules. An actual co-borrower or guarantor is different, and the signed documents must be checked.

Is a character reference responsible for my loan?

Not merely because the person was named as a reference. Liability normally requires a legal or contractual basis, such as a valid guaranty. A lender should not represent an ordinary character reference as a debtor without supporting documents.

Can the app use the contacts permission I accepted?

Permission on the phone is not unlimited legal authority. NPC rules prohibit harvesting phone, email, or social-media contact lists for harassment or collection. Any processing must still be lawful, transparent, necessary, and proportionate.

Can I complain if the loan is overdue?

Yes. Being late does not remove your privacy rights or permit abusive collection. Your payment obligation, however, must be addressed separately.

Can collectors have me arrested for unpaid debt?

A purely civil failure to pay a debt does not by itself justify imprisonment. Different facts—such as alleged fraud or another independently defined offense—require separate proof and legal process. Collectors cannot lawfully impersonate authorities or use false threats of arrest to force payment.

Should I complain to both the SEC and NPC?

Often, yes. The SEC addresses the conduct and regulatory compliance of lending or financing companies; the NPC addresses personal-data processing and disclosure. If the provider is BSP-supervised, use its internal complaint mechanism and the BSP route as well.

Can someone contacted by the lender file a complaint?

Potentially. A relative, friend, co-worker, or other contact may be a data subject in their own right if the app obtained or used that person’s name, number, relationship, messages, or other personal information unlawfully.

Is there one universal filing deadline?

No. Different administrative, civil, and criminal remedies have different prescriptive periods and procedural deadlines. Do not delay. An order received from a regulator, prosecutor, or court may carry a short deadline even when the underlying claim has a longer prescriptive period.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and conclusions may depend on the regulator, loan documents, evidence, and particular facts. Official sources and filing guidance were checked on September 3, 2026.