Quick answer

If an online lending app, lender, or collection agent threatens, humiliates, repeatedly abuses, publicly shames, or contacts people in your phone to pressure you, preserve the evidence and complain through the proper channels:

Send a written complaint and cease-and-desist request to the lender or app operator.
Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission (SEC).
File a privacy complaint with the National Privacy Commission (NPC) if your contacts, photos, messages, identity documents, loan information, or other personal data were accessed, used, or disclosed unlawfully.
If the lender is a bank or another BSP-supervised institution, use its internal consumer-assistance channel first, then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).
Report credible threats, extortion, impersonation, hacking, or other suspected crimes promptly to the police or National Bureau of Investigation (NBI).

These remedies can overlap. Filing with one agency does not automatically file a complaint with the others. A valid debt also does not give a lender permission to harass you or misuse your data. At the same time, reporting misconduct does not by itself erase, suspend, or settle a lawful loan obligation.

What conduct may be reportable?

A lender may make lawful, proportionate efforts to collect an unpaid debt. It may generally contact the borrower, provide an account statement, demand payment, explain lawful consequences, and offer a payment arrangement. The line is crossed when collection becomes abusive, deceptive, needlessly public, or unlawfully intrusive.

Possible unfair collection practices include:

Using threats of violence, harm, arrest, or action that the collector cannot lawfully take
Using insults, profanity, obscenities, or humiliating language
Falsely claiming to be a police officer, lawyer, court employee, government agency, or other person
Using deceptive representations to collect the debt
Publicly posting or circulating the borrower’s name, photo, loan details, or alleged delinquency to shame the borrower
Contacting an employer, co-worker, relative, friend, or unrelated person merely to embarrass or pressure the borrower
Communicating at unreasonable or inconvenient times or places, subject to legally recognized exceptions
Using a borrower’s contact list to message people who were not declared guarantors
Continuing abusive conduct through multiple numbers, accounts, or collection agents after receiving a formal complaint

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by financing and lending companies. The Financial Products and Services Consumer Protection Act also prohibits financial service providers from using abusive collection or debt-recovery practices and makes them responsible for certain acts of their employees, agents, and accredited third-party service providers. See Republic Act No. 11765 and the SEC’s official page for Memorandum Circular No. 18, Series of 2019.

Whether particular messages are legally abusive depends on their wording, frequency, timing, audience, and context. A firm but truthful demand is not automatically harassment. A threat, deceptive claim, public-shaming campaign, or disclosure to unrelated people may be.

When does collection become a privacy violation?

The Data Privacy Act requires personal data processing to have a lawful basis and to follow transparency, legitimate-purpose, and proportionality principles. Consent given when installing an app is not unlimited permission to use every item on a phone for any purpose.

A privacy issue may exist when an app or collector:

Accesses contacts, photographs, messages, social-media information, location data, or files beyond what is necessary and lawfully justified
Uses personal data for a purpose materially different from the purpose disclosed
Discloses a borrower’s debt or loan information to unrelated third parties
Uploads or circulates a borrower’s photograph, identification document, or personal details
Uses a person’s identity, photograph, or account without authority
Refuses to explain what information it holds, where it came from, why it is being processed, or to whom it was disclosed
Keeps inaccurate information and refuses a proper correction request
Fails to use reasonable safeguards for personal information
Contacts people found in the borrower’s phone solely to pressure the borrower

Under the NPC’s amended rules for loan-related transactions, a lender or person acting as one is expressly prohibited, for debt-collection purposes, from contacting people in the borrower’s contact list other than persons declared as guarantors. A guarantor must have expressly bound himself or herself to answer for the borrower’s obligation, and the lender must obtain the guarantor’s separate consent. Merely appearing in someone’s contacts—or being named as a character reference—does not by itself make that person a guarantor.

Character references must be informed that they were named, told how their contact details were obtained, and given an option to have their data removed as a character reference. Their data may not be used for unrelated marketing, cross-selling, or similar purposes. See NPC Circular No. 2022-02 and the NPC’s official explanation of the amendments.

Protect yourself and preserve evidence first

Do not immediately delete the app, messages, or call records before preserving what happened. Some information may disappear once access is revoked or an account is closed.

Save the following where available:

Full screenshots showing the message, sender’s number or account, date, and time
Screen recordings showing the entire conversation or post, including the account profile and URL
Original emails, text messages, voicemails, and call logs
Copies of messages sent to relatives, friends, employers, or co-workers
Written statements or affidavits from people contacted by the collector
The app’s name, developer, app-store page, website, download link, and privacy notice
Screenshots of the permissions requested by the app
The lender’s corporate name, SEC registration details, certificate-of-authority information, business address, and collection agency
Loan agreement, disclosure statement, promissory note, amortization schedule, receipts, payment records, and account statement
Proof of what you actually received and what you have already paid
Your written complaint to the lender and proof that it was received
Any reply, ticket number, settlement proposal, or acknowledgment from the lender
A chronological incident log identifying each call, message, disclosure, threat, and person contacted

Keep original files when possible. Back them up to a secure device or account. Avoid editing or cropping away identifying information. If a social-media post is involved, preserve both screenshots and the direct link.

After preserving evidence, review the app’s permissions and remove unnecessary access to contacts, storage, camera, microphone, location, and social-media accounts. Change passwords if you suspect account access, enable multi-factor authentication, and notify affected contacts that unauthorized messages may be sent in your name.

Do not publish your full identification documents, loan account number, home address, or other sensitive evidence on social media. Provide them only through verified official complaint channels.

Step 1: Complain to the lender in writing

Send the lender, app operator, collection agency, and—if available—their data protection officer a concise written complaint. Use an email address or in-app channel that creates a record.

State:

Your name and loan or account reference
The app and legal company name
The dates and description of the conduct
The numbers, accounts, employees, or agents involved
The people whose data was accessed or who were contacted
The specific correction you want
That you require the harassment, public disclosure, and unauthorized third-party contact to stop
That future collection communications should be sent only through a specified lawful channel
That you request preservation of relevant call recordings, account logs, access logs, collection instructions, and communications

For a privacy complaint, also request an explanation of:

What personal data the company collected
Its lawful basis and purpose for processing
The source of the information
The persons or entities that received it
The retention period
The action taken to stop further unauthorized use or disclosure

Ask for a written response and keep proof of delivery.

This first written notice is especially important for an NPC complaint. Under the NPC’s current Rules of Procedure, a complainant ordinarily must first inform the personal information controller, processor, or concerned entity in writing and allow it to act. If there is no response within 15 calendar days from receipt, or no timely and appropriate action is taken, the complaint may be brought to the NPC.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal action. Do not assume that a waiver will be granted; clearly explain and prove why urgent NPC intervention is necessary.

Step 2: Report unfair collection to the SEC

The SEC generally handles complaints involving lending companies and financing companies, including their online lending platforms and collection conduct.

Use the SEC’s official complaints page for lending and financing companies and follow the current instructions there. The SEC requires:

A completely and accurately accomplished complaint form
One complaint form for each respondent company
A copy of a valid government-issued ID
Supporting evidence, such as messages, screenshots, loan documents, disclosure statements, payment records, receipts, and the amortization schedule

Follow the subject-line format stated on the SEC page if filing by email. Keep the sent email, attachments, acknowledgment, and reference number.

The SEC may send the complaint to the company for an answer or comment and evaluate whether an administrative action is warranted. The SEC’s complaint process does not itself cancel the loan, rewrite payment terms, declare the contract void, or automatically declare an interest provision invalid.

If the app’s brand differs from the lender’s corporate name, identify both. Include any facts that connect the app, collection agency, payment account, and legal lender. An incomplete or wrongly identified respondent can delay evaluation.

Step 3: File a privacy complaint with the NPC

Use the NPC’s current File a Complaint page and download the latest Complaints-Assisted Form. The NPC’s instructions call for a filled-out and notarized form, or another properly verified complaint, with supporting documents and witness affidavits when available. The NPC currently lists personal filing, courier, and email submission options on its formal complaint instructions.

A formal complaint should identify the complainant and respondent, provide contact and service details, narrate the material facts, attach supporting evidence, state the relief requested, and include the correspondence showing that the respondent was first notified. It must also include the required verification and certification against forum shopping.

If the respondent’s true name is unknown, provide all circumstances that could identify it, such as:

App name and icon
Developer and app-store listing
Website and privacy-policy links
Phone numbers, email addresses, and payment accounts
Company names in the loan agreement or disclosure statement
Names used in text messages or collection notices

The certification against forum shopping must disclose whether another action involving the same issues has been filed or is pending. If you later learn that a same or similar action was filed, the NPC rules require you to report that fact within five calendar days. Failure to meet formal requirements can result in dismissal, although the NPC retains limited authority to act on sufficiently serious or informative submissions.

Review the 2021 NPC Rules of Procedure, as amended before filing. Use the latest form and filing instructions rather than relying on an old copy from social media.

Step 4: Use the BSP process if the lender is BSP-supervised

The BSP route applies when the complained-of provider is a bank or another BSP-supervised financial institution. It is not the general complaint channel for every standalone lending app.

First file through the institution’s own Financial Consumer Protection Assistance Mechanism or customer-service channel. If the matter remains unresolved, escalate it through the BSP Consumer Assistance Mechanism, including:

A clear summary of the complaint
The remedy requested
Your contact information
Your complaint to the institution and its response, if any
Supporting documents

The BSP page provides its current online, email, postal, telephone, and walk-in channels. Verify that the entity is BSP-supervised before using this route.

Step 5: Report threats or suspected crimes promptly

Do not wait for an SEC or NPC case if there is an immediate safety risk. Contact emergency services or the nearest police station if a collector threatens violence, appears at your home or workplace in a threatening manner, stalks you, demands money through extortion, compromises an account, or impersonates a government official.

For suspected computer-related crimes, you may also use the NBI’s Online Complaint facility or seek assistance from the NBI Cybercrime Division. Bring your government-issued ID, devices or original files where appropriate, a clear timeline, and copies of the communications.

The precise criminal offense—if any—depends on the actual words, conduct, identity of the sender, method used, and available evidence. Avoid publicly accusing a named person of a crime before authorities have verified the facts.

What to say in a cease-and-desist request

A practical written notice may say:

I dispute and object to the use or disclosure of my personal data for harassment, public shaming, or contact with persons who are not my declared guarantors. Stop those acts immediately. Direct lawful account communications to me through [email or address]. Please identify the company and collection agency responsible, preserve all relevant records, explain what personal data was accessed or disclosed and to whom, and provide your written response and corrective action.

This notice does not need to concede or deny the debt. If you dispute the amount, add a separate request for a complete account statement showing principal, interest, fees, payments, and the basis for each charge.

Do not promise payment you cannot make, sign a replacement agreement you do not understand, or send money to a newly supplied personal account without verifying that the recipient is authorized.

Common mistakes to avoid

Deleting evidence too early

Blocking a number may be necessary for safety, but first capture the messages, account details, timestamps, and full conversation.

Filing against only the app’s brand name

Find the legal lender or financing company named in the agreement, disclosure statement, privacy notice, payment instructions, or SEC records. Include the collection agency if known.

Treating every collection message as illegal

A lender may lawfully request payment. Focus the complaint on specific threats, deception, excessive contacts, third-party disclosures, unauthorized data use, or other documented misconduct.

Assuming app permission equals unlimited consent

A permission prompt does not automatically justify unrelated, excessive, deceptive, or disproportionate processing. Explain exactly what the app accessed and how the data was later used.

Skipping the written complaint to the company

For NPC cases, failure to show prior written notice and the company’s lack of timely appropriate action may lead to dismissal unless a waiver is justified.

Filing screenshots without context

Include the sender, date, time, telephone number or account, preceding messages, URL, and an explanation of who received the communication.

Posting evidence publicly

Public posting may expose your own data, compromise an investigation, or create a separate dispute. Submit evidence privately to the proper agency.

Believing a complaint automatically stops payment obligations

The alleged harassment and the enforceability or amount of the debt are separate questions. Continue to document payments and request a correct statement of account. Obtain legal advice before withholding payment solely because a complaint has been filed.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly when:

There is a credible threat to life, physical safety, employment, or property
Intimate images, identification documents, or sensitive personal information were published
An account or identity appears to have been taken over
You received a subpoena, summons, formal demand, or court document
The lender filed a case or you need immediate injunctive relief
Several companies or collectors are involved and their identities are unclear
You are being asked to sign a waiver, quitclaim, settlement, or new loan agreement
The complaint may overlap with a criminal, civil, SEC, BSP, or NPC proceeding
A filing deadline may be approaching

Do not ignore court papers. Collection messages that merely threaten “legal action” are different from an actual summons or order issued by a court.

Frequently asked questions

Can a lending app contact everyone in my phone?

For debt collection, a lender or person acting as one may not contact people in the borrower’s contact list other than persons declared as guarantors. A contact or character reference is not automatically a guarantor.

Can the lender contact my employer?

The legality depends on the purpose, information disclosed, necessity, and circumstances. Contact intended to humiliate or pressure you, or disclosure of loan information to unrelated people, may support an unfair-collection or privacy complaint. Preserve the exact communication and identify who received it.

Does owing money remove my privacy rights?

No. A lender may process information on a lawful basis for legitimate loan purposes, but collection must still comply with applicable consumer-protection, privacy, and fair-collection rules.

Should I uninstall the app immediately?

Preserve evidence first. Record the app name, developer, permissions, privacy notice, account screen, loan documents, and messages. Then revoke unnecessary permissions and uninstall it if doing so is appropriate for your security.

Must I wait 15 days before going to the NPC?

Ordinarily, you must first notify the respondent in writing. You may proceed when it fails to respond within 15 calendar days from receipt or does not take timely and appropriate action. The NPC may waive this requirement for properly alleged and proven exceptional circumstances, but waiver is discretionary.

Can I complain to both the SEC and NPC?

Yes, when the facts involve both unfair collection and unlawful personal-data processing. Each agency addresses matters within its jurisdiction, and each complaint must satisfy its own requirements. Disclose related proceedings when a form or certification requires it.

Will the SEC or NPC cancel my loan?

Not automatically. An agency complaint concerns regulatory or privacy violations. Questions about the debt’s validity, computation, enforceability, or settlement may require a separate dispute, negotiation, or court determination.

What if I never borrowed from the app?

State that clearly and preserve evidence of possible identity theft, mistaken identity, or unauthorized use. Demand the source of the data and correction or deletion where legally appropriate. Report suspected identity theft or account compromise promptly to law enforcement as well as the appropriate regulator.

What if the collector keeps changing numbers?

Record each number, message, date, payment instruction, and claimed company identity. Group the incidents into a single timeline and explain why you believe they are connected.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. The proper remedy depends on the lender’s regulatory status, the loan documents, the exact communications, and the available evidence. Official sources and procedures were checked as of August 28, 2026.