Quick answer

If an online lending app is harassing you, threatening you, publicly shaming you, or misusing your phone contacts or other personal data, you may have grounds to report the conduct to more than one agency. Report unfair or abusive debt-collection practices to the Securities and Exchange Commission (SEC); report unlawful processing, disclosure, or other misuse of personal data to the National Privacy Commission (NPC); and report threats, fraud, scams, or other potentially criminal conduct to the appropriate cybercrime or law-enforcement authorities. These remedies can overlap, so filing with one agency does not necessarily prevent you from filing with another.

The government’s joint DICT-NPC-SEC advisory dated 18 March 2026 specifically addresses online lending platforms (OLPs), whether recorded or unrecorded. It prohibits unnecessary app permissions, excessive or disproportionate processing of contact lists, harassment through personal-data processing, debt collection through people other than guarantors, and collection tactics involving threats of violence, criminal means, or threats to take action that cannot legally be taken. Among people obtained from a borrower’s contact list, ordinary contacts and character references must not be used for debt collection; a guarantor must have separately and expressly consented to that role.

Owing a legitimate debt does not give a lender or collection agent permission to harass you or misuse your personal information. At the same time, harassment or a privacy violation does not automatically erase a valid loan. The collection misconduct and the underlying debt should be addressed separately.

What conduct should you report?

The clearest cases include repeated intimidation, threats of violence or other unlawful harm, public shaming, and using information taken from your phone to pressure unrelated people into making you pay. The 2026 government advisory expressly identifies harassment, intimidation, public shaming, and unlawful use of personal data as problems involving OLP collection practices. It also states that unauthorized, excessive, or disproportionate contact-list processing is prohibited.

A particularly important distinction is the difference between a character reference and a guarantor. A character reference is supplied for identification or verification. A guarantor is a person who expressly consents to assume responsibility for the loan in case of default. A lending app cannot simply treat a friend, relative, coworker, or other contact as your guarantor because that person appeared in your phone, was named as a reference, or received a collection message.

This does not mean every communication from a lender is unlawful. A creditor may lawfully seek payment and communicate with the borrower, and a person who is genuinely a co-borrower, guarantor, or otherwise independently liable may be contacted according to the applicable agreement and law. The problem is abusive collection or the use of unrelated third parties and personal data beyond a lawful, necessary, and proportionate purpose.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, separately requires fair and respectful treatment of financial consumers and prohibits financial service providers from employing abusive collection or debt-recovery practices. It also recognizes rights to data privacy, protection of client information, and timely handling of complaints. (Lawphil)

Preserve evidence before blocking numbers or uninstalling the app

Save the evidence first. Collection complaints and privacy complaints are much easier to evaluate when the sequence of events can be reconstructed from records rather than memory.

Keep screenshots or exports showing the app name, developer or publisher, app-store listing, website, privacy notice, permissions requested, loan agreement, disclosure statement, payment history, outstanding-balance information, and any company name or SEC registration details displayed by the platform. Preserve text messages, chat conversations, emails, call logs, voice messages, social-media posts, and screenshots showing the sender's number, account name, date, and time.

If collectors contacted relatives, friends, coworkers, or other persons, ask those recipients to preserve the actual messages they received. Keep copies of the unedited originals for investigators even if you later make redacted copies for other purposes.

Also record the payment accounts, e-wallet numbers, bank accounts, QR codes, telephone numbers, social-media accounts, and names being used by collectors. These details can be important when the app's public-facing brand is different from the legal company operating it.

Do not unnecessarily post your evidence publicly. Screenshots may themselves contain your ID, address, phone number, loan details, contacts, account numbers, or other personal data. Preserve the originals securely and disclose them only as needed to the lender, regulator, law-enforcement authority, or your lawyer.

Step 1: Identify the company behind the lending app

Before filing, determine as much as you reasonably can about the operator. The SEC maintains information on financing and lending companies, recorded online lending platforms, and revoked or suspended entities. Its current lending-and-financing section also contains advisories concerning particular apps and companies. (Securities and Exchange Commission)

Do not rely only on the app's logo or marketing name. Record the corporation named in the loan agreement, privacy notice, terms of service, payment instructions, or app-store developer information. If you cannot identify the legal operator, do not abandon the complaint; provide the SEC or other agency with everything you have, including the app-store link, screenshots, developer name, collector numbers, and payment accounts.

The SEC has also advised borrowers to verify whether the lending or financing company and its OLP are registered or recorded before transacting. Because SEC records can change through suspensions, revocations, new recordings, and enforcement orders, check the SEC's current list rather than relying on an old screenshot or social-media post. (Securities and Exchange Commission)

Step 2: Complain to the lender or financing company in writing

For a financial-consumer complaint, send a clear written complaint to the lender's official consumer-assistance channel. Republic Act No. 11765 requires financial service providers to maintain a consumer-assistance mechanism without charge for complaints, inquiries, and requests, and consumers dissatisfied with the provider's handling may elevate the matter to the regulator with jurisdiction. (Lawphil)

State what happened, identify the collector or number if known, give the relevant dates, and describe who else was contacted. If the problem involves privacy, identify the personal data involved and how you believe it was accessed, disclosed, or used.

Ask for specific corrective action appropriate to the facts—for example, stopping collection messages to persons who are not guarantors, stopping public disclosure of loan information, investigating the collection agent, preserving relevant logs, correcting inaccurate information, and identifying the company's privacy or complaint contact. Keep proof that the company received your complaint.

This written step is especially important if you intend to file a formal complaint with the NPC.

Step 3: Report unfair debt collection to the SEC

The March 2026 DICT-NPC-SEC advisory directs complaints concerning unfair debt-collection practices to the SEC's Financing and Lending Companies Department (FINLEND) through SEC iMessage. It also lists the SEC hotline 1-4732 (1-4SEC).

SEC iMessage is now the Commission's official web-based ticketing platform for public complaints, inquiries, incidents, and requests. The current user guide instructs a complainant to open a new ticket, accept the privacy policy, sign in through an eSECURE account, select the appropriate service, complete the form, and create the ticket. The service list includes “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department. Save the ticket number and monitor the ticket because a closed ticket can sometimes indicate that further compliance or action is required from the filer rather than that nothing more needs to be done. (SEC Philippines)

In the complaint, explain the collection conduct in chronological order. Identify the borrower, app, legal company if known, collector details, loan or account reference, persons contacted, nature of the threats or disclosures, and what you already did to complain to the company. Attach the strongest evidence rather than merely stating that harassment occurred.

A lender generally cannot avoid responsibility simply by saying that an outside collection agency sent the messages. Republic Act No. 11765 makes a financial service provider responsible for acts or omissions of its directors, officers, employees, and agents in transactions with consumers, and provides for solidary liability with accredited third-party service providers for acts or omissions that may include debt collection. (Lawphil)

Step 4: File with the National Privacy Commission when personal data was misused

Consider an NPC complaint when the conduct involves matters such as unauthorized or excessive access to your contacts, disclosure of your loan information to unrelated third parties, use of personal data for harassment, continued processing for an unauthorized purpose, or another violation of your rights under the Data Privacy Act and NPC issuances.

The Data Privacy Act requires a lawful basis for processing personal information and grants data subjects enforceable rights. Its implementing rules also recognize circumstances in which a person may seek blocking, removal, destruction, or correction of data, subject to lawful grounds for continued processing and retention. (National Privacy Commission)

For lending transactions specifically, the 2026 government advisory states that unnecessary permissions are prohibited and that access to contact lists must not become unconstrained or disproportionate processing. Personal data should be retained only as long as necessary for the purpose for which it was obtained, for the establishment, exercise, or defense of legal claims, or as otherwise provided by law; secure disposal should follow when lawful retention is no longer required.

The NPC generally requires prior written notice

Under the NPC's 2021 Rules of Procedure, a complainant ordinarily must first inform the company or other respondent in writing about the privacy violation or personal-data breach and give it an opportunity to act. The requirement is satisfied for purposes of proceeding with the complaint where the respondent fails to take timely or appropriate action, or where there is no response within 15 calendar days from receipt of the written notice. Proof of this step should be attached to the NPC complaint.

There is an important exception. The 15-day exhaustion requirement is not absolute: the NPC may waive some or all of it, in its discretion, for good cause properly alleged and proved or where the allegations involve a serious Data Privacy Act violation or breach and the risk of harm warrants intervention. The Rules mention circumstances such as grave and irreparable damage that only NPC action can prevent or mitigate, the absence of a plain, speedy, or adequate remedy from the respondent, or patently illegal conduct. A complainant relying on this exception should expressly explain and support why a waiver is necessary rather than simply omitting the prior-notice step.

Use the current NPC complaint form

The NPC announced a new Complaint-Affidavit template effective 1 July 2025 and stated that the previous version would no longer be accepted after the transition period. Use the latest form available from the NPC rather than an old copy circulating online. (National Privacy Commission)

The NPC's current filing instructions state that the complaint form should be completed and notarized and may be submitted personally, through courier, or by scanning and sending it through the NPC's designated complaint email channel. Its more detailed mechanics also permit registered mail and electronic filing as authorized by the Commission and require supporting evidence and, where applicable, witness affidavits. (National Privacy Commission)

NPC's May 2025 Service Request and Assessment Form lists a ₱500 filing fee for complaints, plus a legal research fee equal to 1% of the filing fee but not less than ₱10. Additional filing fees apply when damages are claimed, depending on the amount sought. Check the NPC's current assessment and payment instructions before paying because fees and procedures can be amended.

Step 5: Report threats, fraud, scams, and other potentially criminal conduct

Some conduct goes beyond regulatory debt-collection or privacy issues. The March 2026 joint advisory directs other forms of harassment, threats, fraud, and scams to cybercrime authorities and identifies these current reporting contacts: the DICT Cyber Hotline at 1326@dict.gov.ph; the NBI Cybercrime Division at ccd@nbi.gov.ph and (632) 8523-8231 to 38; and the PNP Anti-Cybercrime Group at acg@pnp.gov.ph or onlinecims.ocs@gmail.com, telephone (632) 8723-0401 local 7491.

Do not assume that every rude or aggressive collection message automatically constitutes a particular criminal offense. Criminal liability depends on the exact words or acts, intent, surrounding circumstances, identity of the actor, evidence, and the elements of the applicable offense. Preserve the evidence and describe what actually happened rather than trying to assign a criminal label yourself.

If there is a credible threat of imminent physical harm, extortion, stalking, doxxing that creates an immediate safety risk, account takeover, or another rapidly escalating situation, seek law-enforcement assistance promptly. You do not need to wait for the SEC or NPC administrative process to finish before reporting an urgent safety or criminal matter.

Do not confuse consent with unlimited permission

A common defense is that the borrower clicked “Allow” when installing the app. That does not necessarily authorize every later use of the information.

The 2026 advisory states that OLPs must not demand unnecessary permissions and that contact-list processing cannot be unauthorized, excessive, or disproportionate. It specifically warns against deceptive interface designs that manipulate users into granting broader consent and says permissions should be revoked or turned off when the purpose for which they were granted has already been achieved.

Consent also does not transform a character reference into a guarantor. A person becomes a guarantor for these purposes only after separately consenting to assume that responsibility.

Can you ask the app to delete your data?

You can invoke applicable data-subject and financial-consumer rights and request deletion or removal where legally justified, but deletion is not always immediate or absolute. Republic Act No. 11765 recognizes a client's right to request removal of data from a provider's system when the client no longer wishes to use the service, while privacy law recognizes circumstances where continued retention may still have a lawful basis. (Lawphil)

For OLPs, the 2026 advisory expressly allows retention while the data remains necessary for the purpose for which it was collected, for establishing, exercising, or defending legal claims, or when retention is required by law. The existence of a legitimate retention reason, however, does not authorize using retained information for harassment, public shaming, or unrelated collection pressure.

What can the SEC and NPC actually do?

The SEC can investigate and take regulatory or enforcement action against entities within its jurisdiction. Under the Financial Products and Services Consumer Protection Act, financial regulators have powers that can include fines, restrictions, suspension, cease-and-desist measures, and other enforcement action when the statutory conditions are established. The March 2026 advisory likewise warns that violations may result in administrative sanctions including fines and suspension or revocation of authority to operate. (Lawphil)

The SEC's adjudicatory power under Republic Act No. 11765 also extends to certain actions connected with financial transactions that are purely civil in nature where the relief sought is solely payment or reimbursement of money not exceeding ₱10 million. That threshold should not be confused with the ordinary process for simply reporting collection misconduct. (Lawphil)

The NPC may investigate Data Privacy Act violations and, after the required proceedings, may issue enforcement orders, award indemnity on matters involving data protection or data-subject rights, impose a permanent ban on processing, impose fines where authorized, and recommend prosecution to the Department of Justice. Whether any of those remedies is granted depends on the evidence and findings in the particular case.

The Data Privacy Act also contains separate criminal offenses involving conduct such as unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure, with penalties depending on the particular offense and the type of information involved. A privacy complaint or allegation by itself does not establish criminal guilt. (National Privacy Commission)

Deadlines and thresholds to keep in mind

For an NPC complaint, the most immediate procedural period is the general 15-calendar-day opportunity for the respondent to act after receiving your written privacy complaint, subject to the NPC's discretionary waiver in qualifying circumstances. Keep proof of the date of receipt because that date determines when the 15 days begin.

For claims accruing under Republic Act No. 11765 and its implementing rules, Section 14 generally provides a five-year prescriptive period from consummation of the financial-consumer transaction or five years from discovery of deceit or nondisclosure of material facts, subject to an outside limit of 10 years from the violation and the statute's insurance exception. That rule does not automatically supply the limitation period for every separate criminal, privacy, civil, or cybercrime claim that could arise from the same events. (Lawphil)

Do not wait for a limitation period to become close before preserving evidence or reporting ongoing misconduct. Phone numbers disappear, accounts are deleted, apps change names, messages are unsent, and witnesses may lose access to their records.

Common mistakes that can weaken a complaint

One frequent mistake is uninstalling the app, deleting messages, or resetting the phone before preserving evidence. Another is identifying only the app's brand name while leaving out the legal company name, developer, payment account, collector numbers, or other identifiers that investigators could use to trace the operator.

Another problem is making only a telephone complaint to the lender when an NPC filing may later require proof that the company was notified in writing. Send a traceable written complaint and preserve proof of receipt.

Do not assume that every person listed as a reference became legally responsible for the loan. Character references and guarantors have different roles under the NPC-SEC guidance, and a guarantor must separately consent to that obligation.

Also avoid assuming that a complaint automatically suspends or cancels a valid debt. Continue to document any legitimate payments or formal dispute over the amount due, while separately challenging abusive collection conduct.

Finally, do not use an old NPC form or abandon an SEC iMessage ticket after submission. NPC changed its Complaint-Affidavit form in 2025, while SEC iMessage allows users to monitor tickets and respond when further compliance is requested. (National Privacy Commission)

When legal help is particularly urgent

Consider obtaining individualized legal assistance promptly if the collector is threatening physical harm; publishing or threatening to publish highly sensitive information; impersonating law-enforcement or court personnel; demanding money through threats unrelated to lawful collection; using altered photographs or fabricated accusations; repeatedly contacting large numbers of people from your phone; or continuing serious privacy violations despite written demands to stop.

Legal advice may also be useful when you want damages, need urgent injunctive or privacy relief, cannot identify the real operator behind the app, are dealing with several lenders or collection agencies at once, or need to determine whether the underlying loan, charges, collection demand, or claimed balance itself is legally enforceable.

Frequently asked questions

Can a lending app contact my family, friends, coworkers, or other phone contacts?

Not for debt collection merely because those people appear in your contact list or were named as character references. The March 2026 joint advisory says that, for debt collection, persons in the borrower's contact list other than guarantors must not be contacted, and a guarantor must have expressly consented to that role. The situation is different for an actual co-borrower, guarantor, or another person who is independently liable under the transaction.

I really owe the money. Can I still report harassment?

Yes. A lender may pursue lawful collection, but Republic Act No. 11765 prohibits abusive collection or debt-recovery practices, and privacy rules continue to apply to personal data used during collection. Reporting misconduct does not require pretending that no debt exists. (Lawphil)

I allowed the app to access my contacts. Does that make collection messages to everyone legal?

No. App permission is not unlimited authorization. Government guidance prohibits unauthorized, excessive, or disproportionate contact-list processing and specifically prohibits using contacts other than guarantors for debt collection.

Should I file with the SEC or the NPC?

Use the SEC for unfair or abusive lending and collection conduct and the NPC when the facts involve unlawful processing, disclosure, access, or other misuse of personal data. If the same acts involve both—for example, a collector extracts contacts and messages them to shame the borrower—both complaints may be appropriate.

Do I have to wait 15 days before going to the NPC?

Ordinarily, you should first notify the respondent in writing and allow it to act; no response within 15 calendar days from receipt is one basis for satisfying the exhaustion requirement. However, the NPC Rules allow the Commission, in its discretion, to waive that requirement for good cause or serious privacy violations where the risk of harm and other specified circumstances justify immediate intervention.

What if the online lending app is not on the SEC's recorded list?

Preserve the evidence and report it rather than assuming that an unrecorded app is beyond government jurisdiction. The March 2026 advisory expressly covers entities offering or facilitating loans through OLPs whether recorded or unrecorded, and the SEC maintains current lists and enforcement advisories that can help verify an operator's status.

Official sources

General-information disclaimer

This article provides general legal information for the Philippines and is not a substitute for advice based on the specific loan documents, communications, identities of the parties, evidence, and surrounding facts of an individual case. Agency procedures, forms, contact details, fees, and regulatory status of particular lenders or apps can change, so confirm the latest instructions on the official SEC, NPC, DICT, NBI, or PNP pages before filing. Law and official-source check: 23 August 2026.