Quick answer

Report online lending app harassment to the regulator that supervises the lender—usually the Securities and Exchange Commission (SEC)—and report misuse of personal data to the National Privacy Commission (NPC). If the lender is a bank or another BSP-supervised institution, use the Bangko Sentral ng Pilipinas (BSP) complaint process instead. Threats, extortion, impersonation, account hacking, or immediate safety risks should also be reported promptly to law enforcement.

Before filing, preserve the messages, call logs, app details, loan documents, payment records, and proof that the lender contacted other people or exposed your information. Send the lender a written complaint and demand that the harassment and unlawful processing stop. For an ordinary NPC complaint, you generally must show that the company failed to take appropriate action or did not respond within 15 calendar days after receiving your written notice. The NPC may waive that requirement in serious or plainly illegal cases.

Reporting misconduct does not automatically cancel a valid loan, suspend its due date, or erase lawful interest and charges. Continue addressing the legitimate debt separately, obtain a written statement of account, and pay only through a verified official channel.

Conduct you may report

A lender may make lawful, proportionate efforts to collect an overdue debt. It may send reminders, demand payment, offer restructuring, or pursue remedies permitted by the contract and law. It may not use collection as an excuse to intimidate, humiliate, deceive, or indiscriminately expose personal information.

Potentially reportable conduct includes:

Threatening violence, physical harm, property damage, arrest, public exposure, or another action the collector has no lawful authority or genuine basis to take.
Using insults, profanity, sexually degrading language, repeated intimidation, or other abusive communications.
Pretending to be a police officer, court employee, lawyer, government agency, or another person.
Sending fabricated warrants, court notices, barangay documents, or criminal-case claims.
Posting or threatening to post the borrower’s name, photograph, identification document, loan information, or edited “wanted” material on social media.
Telling relatives, co-workers, employers, customers, neighbors, or unrelated contacts about the debt to pressure or shame the borrower.
Contacting people taken from the borrower’s phone, email, or social-media contact lists for debt collection when they were not validly designated guarantors.
Treating a character reference as liable for the loan merely because the borrower supplied the person’s name.
Accessing contacts, photographs, camera functions, location data, messages, or other device information beyond what is necessary and lawfully justified.
Using a borrower’s photograph to harass or embarrass the borrower.
Continuing to use a character reference’s information after that person asks for its removal, subject to any lawful retention requirement.
Refusing to identify the lending company, collection agency, or account involved.
Collecting through an unregistered company or an app that is not operated by a lending or financing company authorized by the SEC.

The SEC’s rules make financing and lending companies responsible for unfair collection practices carried out through their employees, collection agents, and third-party service providers. Hiring an outside collector does not by itself remove the lender’s regulatory responsibility.

Privacy rules for contacts and references

Under the Data Privacy Act, personal-data processing must have a lawful basis and comply with transparency, legitimate purpose, and proportionality.

The NPC’s loan-transaction rules prohibit unbridled or excessive processing of a borrower’s contact list. An app may provide a limited interface allowing the borrower to select a character reference or guarantor, but it should not indiscriminately harvest or use the entire contact list for collection.

The distinction matters:

A character reference may be contacted to verify the borrower’s identity and the truth of information supplied during the loan application. The lender must explain that the person was named as a reference, how the contact details were obtained, and how the person can request removal. A reference is not automatically a guarantor.
A guarantor must have expressly agreed to answer for the borrower’s obligation in accordance with the law. For debt-collection purposes, the lender may contact the guarantor, but not unrelated people found in the borrower’s contact list.

The borrower’s acceptance of broad app permissions does not automatically make excessive, unfair, or harassing processing lawful. Consent under the Data Privacy Act must be freely given, specific, informed, and evidenced by written, electronic, or recorded means. Other lawful grounds may sometimes apply, but the processing must still be necessary and proportionate.

What to do immediately

1. Protect yourself and your accounts

If safe to do so:

Revoke the app’s access to contacts, camera, photographs, location, microphone, storage, and other unnecessary permissions.
Change passwords for your email, social-media, banking, and e-wallet accounts, especially if passwords were reused.
Enable multi-factor authentication.
Review active sessions and sign out unfamiliar devices.
Tell affected contacts not to send money, disclose personal information, or engage with collectors claiming to act for you.
Contact your bank or e-wallet provider immediately if account credentials, one-time passwords, or unauthorized transactions are involved.

Do not delete the app until you have recorded its name, developer, version, permissions, privacy notice, loan details, and relevant screens. Uninstalling it may remove useful evidence.

2. Preserve evidence before blocking anyone

Keep the original electronic evidence whenever possible. Save:

Full screenshots showing the sender, phone number or account, date, time, and complete message.
Screen recordings showing the message thread, social-media post, app page, or notification in context.
Call logs and contemporaneous notes describing what was said, by whom, and when.
Voicemails and messages already received. Be cautious about secretly recording live private conversations because separate laws may apply.
URLs and screenshots of public posts, including the profile name and date accessed.
The app-store listing, developer name, download link, app version, and requested permissions.
The privacy notice, loan agreement, disclosure statement, repayment schedule, statement of account, receipts, and transaction references.
The collector’s name, company, phone numbers, email addresses, payment instructions, and bank or e-wallet account details.
Messages received by relatives, co-workers, references, or other contacts. Ask each recipient to preserve the original and prepare an affidavit if needed.
Your written complaint to the company, proof of delivery, and its response.
Any police, barangay, platform, telecom, or app-store report and its reference number.

Do not crop away identifying details. Keep unedited originals and make backup copies. When sending evidence to an agency, redact unrelated passwords, PINs, one-time passwords, and full financial-account credentials.

3. Identify the legal lender

The app’s brand may differ from the corporation that issued the loan. Check the loan agreement, disclosure statement, privacy notice, collection message, payment recipient, and app-store developer details.

Ask the collector in writing for:

The full legal name and address of the creditor.
The SEC registration number and Certificate of Authority number, if it claims to be a lending or financing company.
The collector’s name and authority to act for the creditor.
An itemized statement of account showing principal, interest, fees, penalties, payments, and current balance.
The contractual and legal basis for any disputed charge.
The company’s data-protection officer or privacy contact.

A corporation’s registration alone does not prove that it holds authority to operate as a lending or financing company.

4. Send a written cease-and-complaint notice

Write to the lender’s customer-assistance unit and data-protection officer using an address listed in the contract, privacy notice, or official company channel. State:

Your name and loan or account reference.
The dates and details of the harassment or data use.
The phone numbers, accounts, or collectors involved.
Which people were contacted and what information was disclosed.
The permissions or data you believe were unnecessarily accessed.
That you demand an end to abusive collection and unauthorized disclosure.
That unrelated contacts must no longer be contacted.
Any request to access, correct, block, erase, or object to processing, subject to lawful exceptions.
Your request for an investigation, preservation of records, and a written response.
A safe channel and reasonable time for legitimate account communications.

Ask for acknowledgment and retain proof of receipt. Avoid admitting an amount you genuinely dispute. Acknowledgment of a debt may have legal consequences, including possible effects on prescription.

Where to file

More than one agency may have jurisdiction. You may file parallel reports when the conduct involves both unfair collection and privacy violations, but disclose other pending proceedings when a form or rule requires it.

SEC: lending and financing companies

For an online lending platform operated by a lending or financing company, submit the complaint through the SEC’s iMessage portal or contact the Financial and Lending Company Division at flcd_complaints@sec.gov.ph. The SEC may address unauthorized lending operations and violations of its unfair debt-collection rules.

Include, as applicable:

Your completed complaint or detailed signed narrative.
A valid government-issued ID.
The loan agreement and disclosure statement, if available.
Screenshots, call logs, posts, witness statements, and payment records.
The lender’s corporate and app details.
Your written complaint to the lender, proof it was received, and its response.
The specific relief requested.

If the operator’s legal identity is unknown, provide every available identifier, including app-store links, phone numbers, payment accounts, URLs, and screenshots.

NPC: privacy violations

Use the NPC’s official complaint filing instructions and form. The current instructions require the prescribed complaint form to be completed, printed, notarized, and submitted in person, by courier, or as a scanned copy by email to complaints@privacy.gov.ph. Check the official page before filing for the current form, address, and applicable fees.

An NPC complaint generally must be written, signed, verified, and supported by evidence. It should identify the complainant and respondent, narrate the material facts, state the requested relief, attach relevant correspondence and evidence, and include the required certification against forum shopping.

Ordinarily, first notify the company in writing. Attach proof that it did not take timely or appropriate action or failed to respond within 15 calendar days of receiving your notice. The NPC may waive exhaustion for good cause or a serious violation, including situations involving grave and irreparable harm, the absence of an adequate remedy, or conduct that is patently illegal. Explain and support the urgency rather than simply omitting the prior notice.

A filing fee may apply, subject to the NPC’s current schedule and exemptions or waiver rules. In cases where continued processing may cause grave and irreparable injury, the NPC rules also provide a procedure for applying for a temporary ban on processing; legal assistance is advisable for that application.

BSP: banks and other BSP-supervised institutions

If the credit provider is a bank, digital bank, non-bank electronic-money issuer, pawnshop, or another BSP-supervised financial institution, complain first through the institution’s own financial consumer assistance mechanism.

If the matter remains unresolved, escalate it through the BSP Online Buddy and Consumer Assistance Mechanism. If you cannot use the chatbot, the BSP states that its complaint form may be emailed to consumeraffairs@bsp.gov.ph with proof of your earlier complaint and supporting documents.

Some apps involve more than one entity—for example, an SEC-regulated lender using a BSP-supervised e-wallet only as a payment channel. Direct the collection complaint to the lender’s regulator and any separate payment or account complaint to the institution responsible for that service.

Law enforcement: threats, extortion, hacking, fraud, or impersonation

Contact the police immediately when there is a credible threat to life, physical safety, children, home, or workplace. Do not wait for an administrative complaint to be resolved.

Cyber-enabled threats, extortion, impersonation, unauthorized account access, identity misuse, or fraudulent documents may also be reported through:

The NBI’s online complaint facility or a regional or district NBI office.
The NBI Cybercrime Division at ccd@nbi.gov.ph.
The DOJ’s official cybercrime incident reporting page.
The nearest police station or appropriate PNP cybercrime office.

Bring an identification document, the device containing the original evidence if requested, printed and electronic copies of the evidence, account details, and a clear chronology. Administrative agencies determine regulatory or privacy liability; criminal liability is investigated and decided through a separate process.

Suggested complaint outline

Use a factual, chronological account:

Identify yourself, the lender, the app, the loan reference, and the collector.
State when the loan was obtained and whether the balance or charges are disputed.
List each incident by date, time, sender, recipient, communication channel, and exact conduct.
Identify the personal information accessed, used, or disclosed.
Explain whether each third party was an unrelated contact, character reference, co-maker, or guarantor.
Describe the harm or continuing risk.
State when you notified the company, how it received the notice, and what it did.
List and label every attachment.
Request specific relief, such as stopping third-party contact, correcting the account, deleting unlawfully obtained data where legally proper, preserving processing records, investigating the collector, and imposing appropriate regulatory measures.

Avoid exaggeration. Separate what you personally witnessed from what another person told you, and obtain that person’s own screenshots or affidavit whenever possible.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Sending only cropped screenshots that omit the sender, date, or surrounding conversation.
Naming only the app brand and not the corporation, collector, developer, or payment recipient.
Filing an ordinary NPC complaint without first sending written notice or explaining why exhaustion should be waived.
Failing to attach proof that the company received the written complaint.
Assuming that every collection reminder is illegal. The issue is whether the method, content, timing, recipient, or data processing was unlawful or unfair.
Assuming that reporting harassment eliminates the debt.
Paying a personal account or unfamiliar e-wallet number supplied by a collector without independently verifying it with the creditor.
Sharing PINs, passwords, one-time passwords, or complete card and account credentials with a supposed collector or government agency.
Publicly reposting other victims’ personal information while trying to expose the lender.
Threatening collectors, fabricating evidence, or making statements that cannot be supported.
Ignoring genuine summonses, subpoenas, barangay notices, or court papers. Verify them directly with the issuing office and seek legal advice promptly.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office, if eligible, as soon as possible when:

A credible threat of violence, stalking, or workplace confrontation is involved.
Intimate images, identification documents, medical information, or children’s data were exposed or threatened.
Money was taken through unauthorized transactions or account takeover.
The company is demanding payment for a loan you did not obtain.
You receive authentic court papers, a prosecutor’s subpoena, or a demand involving a check or alleged fraud.
The lender has contacted many people, published information, or caused serious employment, safety, or reputational harm.
You need an urgent restraining remedy or an NPC temporary ban on processing.
You are considering damages or criminal charges, or prescription periods may be relevant.
You are being asked to sign a waiver, settlement, acknowledgment, restructuring agreement, or quitclaim you do not fully understand.

For purely civil nonpayment of debt, the Constitution prohibits imprisonment for debt. This does not protect separate criminal conduct, such as fraud, nor does it prevent a creditor from pursuing lawful civil remedies.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. NPC rules prohibit unbridled processing of contact lists and debt collection through people other than validly named guarantors. An app may provide limited access so the borrower can select a reference or guarantor, but indiscriminate harvesting and contact for harassment or collection is prohibited.

Can the lender call my character reference about payment?

A character reference is for verifying identity and application information and is not automatically a guarantor. The NPC prohibits contacting a character reference for unrelated purposes. Only someone who expressly agreed to be a guarantor may be contacted in that capacity for debt collection.

Does giving the app permission make contact-list collection legal?

Not automatically. Consent must be specific and informed, and processing must remain necessary, proportionate, and consistent with the stated legitimate purpose. Broad app permission does not authorize harassment, public shaming, or indiscriminate disclosure.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers or accounts for safety, but give the lender one controlled written channel for legitimate account communications if practical. Blocking a collector does not resolve the debt or stop formal legal notices.

Can I complain even if I really owe money?

Yes. A valid debt does not authorize abusive collection or unlawful processing. Keep the misconduct complaint separate from any request for a statement of account, payment arrangement, or dispute over charges.

Can a relative or co-worker file the privacy complaint?

A person whose own data was misused may file as the affected data subject. A representative may file for another data subject if properly authorized, generally through a special power of attorney under the NPC rules.

Will the SEC or NPC remove the debt from my record?

Not merely because a complaint was filed. The agencies may investigate regulatory or privacy violations and order remedies within their authority. The validity and amount of the debt depend on the contract, payments, disclosures, applicable law, and any competent adjudication.

What if I cannot identify the company behind the app?

Preserve the app-store page, developer name, URLs, numbers, payment accounts, privacy notice, messages, and transaction records. State in the complaint that the legal identity is unknown and describe all circumstances that may enable the agency to identify the respondent.

Official legal and procedural sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights, liability, remedies, and filing requirements depend on the documents and specific facts. Official sources and procedures were checked on August 26, 2026.