Quick answer

Report online lending app harassment to the regulator that supervises the lender and report misuse of personal data to the National Privacy Commission (NPC). For most lending and financing companies, file with the Securities and Exchange Commission (SEC). If the provider is a bank, e-wallet issuer, or another BSP-supervised institution, complain first through the institution’s consumer-assistance channel, then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).

If collectors threaten violence, extortion, arrest without legal basis, or immediate harm—or impersonate police, court personnel, or lawyers—preserve the messages and promptly approach the Philippine National Police, the NBI Cybercrime Division, or another appropriate law-enforcement office. Call 911 if anyone is in immediate danger.

Harassment does not cancel a valid debt, but owing money does not give a lender or collection agent the right to threaten, shame, deceive, or misuse personal information.

Conduct you can report

Collection activity may warrant a complaint when the lender, app operator, employee, or third-party collector:

Threatens violence, injury, property damage, arrest, public humiliation, or another action that cannot legally be taken.
Uses obscene, insulting, or abusive language.
Repeatedly calls or messages in a manner intended to harass, oppress, or intimidate.
Pretends to be a police officer, court employee, government official, lawyer, or law firm.
Sends a fabricated warrant, subpoena, criminal charge, court order, or government notice.
Posts or circulates your name, photograph, loan balance, identification document, or alleged delinquency to shame you.
Messages your relatives, friends, co-workers, employer, social-media contacts, or other people who are not proper guarantors merely to pressure you.
Uses your photograph to embarrass or threaten you.
Accesses or processes phone contacts, email contacts, or social-media contacts excessively or for an unrelated purpose.
Continues using permissions or data that are no longer necessary for the loan transaction.
Treats a character reference as responsible for the loan even though that person did not separately and expressly agree to be a guarantor.
Uses a character reference’s information for collection, marketing, cross-selling, or unrelated offers.
Refuses to identify the legal company behind the app or the collection agency acting for it.

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by lending and financing companies and makes them responsible for collection practices performed through third-party service providers. The NPC’s loan-related data rules separately prohibit excessive contact-list processing, processing that leads to harassment, and contacting people in the borrower’s contact list for debt collection unless they were properly named as guarantors.

What online lenders may lawfully do

A lender may make reasonable collection demands, send account statements, negotiate payment, engage an authorized collection agency, report credit information through lawful channels, or bring a proper civil action. A genuine demand letter or summons should not be ignored merely because the debt is disputed.

A character reference is not automatically a guarantor. Under NPC Circular No. 2022-02, a character reference is generally for verifying the borrower’s identity and information. The lender must explain how it obtained the reference’s details and offer the reference an option to have the data removed. A guarantor, by contrast, must separately and expressly agree to answer for the borrower’s obligation in accordance with law.

Consent to install an app is also not unlimited permission to use every item stored on a phone. Personal-data processing must have a lawful basis and comply with transparency, legitimate purpose, and proportionality under the Data Privacy Act of 2012. The NPC rules require loan apps to limit permissions and discontinue access when the relevant purpose has been fulfilled.

Preserve evidence before blocking or uninstalling the app

Create a secure evidence folder and keep the original files whenever possible. Preserve:

Screenshots showing the entire message, sender’s number or account, date, and time.
Screen recordings showing the message thread or public post in context.
URLs, usernames, profile links, group names, and app-store listing.
Call logs and any lawfully obtained voicemail.
Copies of emails, demand letters, delivery envelopes, and chat exports.
The app’s name, developer, package name, version, privacy notice, and permissions.
The lender’s legal corporate name, SEC registration details, certificate of authority, office address, and collection-agency name, if available.
Loan agreement, disclosure statement, promissory note, payment schedule, receipts, and account ledger.
Proof that relatives, co-workers, or other contacts received messages, including their screenshots and written accounts.
Your written complaint to the lender or its data protection officer and proof of delivery.
Any response—or proof that no response arrived within the applicable period.
A chronological incident log identifying what happened, when, through which number or account, and who witnessed it.

Do not crop away identifying details. Keep an unedited copy and back it up. Ask affected contacts to preserve their own copies instead of merely forwarding text to you.

Be cautious about secretly recording private calls. The Anti-Wiretapping Act can apply to unauthorized recording of private communications. Call logs, voicemails left by the collector, written messages, and screenshots are generally safer forms of documentation; obtain legal advice before relying on a covert recording.

Take these immediate protective steps

Preserve the evidence first. Blocking a number, deleting the app, or resetting the phone may remove information needed for a complaint.
Review and revoke unnecessary permissions. Turn off access to contacts, photos, files, location, microphone, and camera when the app no longer has a legitimate need for them.
Secure your accounts. Change reused passwords, enable multi-factor authentication, review active sessions, and alert your mobile carrier or financial institution if account takeover or unauthorized transactions are suspected.
Send a written stop-and-correct demand. Address it to the lender and, if identified, its data protection officer and collection agency. Specify the conduct, numbers or accounts used, dates, people contacted, and data disclosed. Demand that harassment and unauthorized disclosure stop, that inaccurate data be corrected, and that unnecessary processing be discontinued. Request a written response and preserve proof of receipt.
Keep legitimate payment issues separate. Ask for an itemized statement of principal, interest, fees, payments, and claimed balance. If you dispute the debt, say exactly what is disputed. Do not send money to an unfamiliar personal account merely because a collector threatens you.
Report public content to the platform. Request preservation and removal through the social network, messaging service, or app store, but save the evidence before the content disappears.

How to complain to the SEC

The SEC generally supervises Philippine lending companies and financing companies, including their declared online lending platforms. A complaint may address unfair collection practices, an unauthorized or unregistered lending operation, misleading representations, or the conduct of a third-party collector.

Send a clear complaint to the SEC Financial and Lending Company Division through:

Email: flcd_complaints@sec.gov.ph
Telephone: (02) 8818-5990
Online helpdesk: SEC iMessage

Include:

Your full name and reliable contact details.
The app’s name and the legal company behind it, if known.
Loan or account reference number, with sensitive details redacted where unnecessary.
A dated, factual narrative.
The collector’s phone numbers, email addresses, usernames, and claimed agency.
Copies of the loan documents, communications, public posts, and payment records.
The names of people contacted and their supporting statements or screenshots.
The remedy requested, such as investigation, cessation of harassment, correction of records, or verification of the lender’s authority.

An app’s brand name may differ from its corporate operator. Identify both where possible. If the operator is unclear, provide the app-store page, privacy notice, payment instructions, bank or e-wallet recipient details, and every corporate name appearing in the loan documents.

How to file a privacy complaint with the NPC

Use the NPC route when the complaint involves contact harvesting, unauthorized disclosure, public shaming, excessive app permissions, misuse of photographs or IDs, refusal to honor data-subject rights, or other unlawful processing of personal data.

First notify the respondent in writing

As a general rule, the NPC requires exhaustion of remedies. Inform the lender, app operator, or other respondent in writing of the privacy violation and give it an opportunity to act. Keep proof that the respondent received the notice.

A formal NPC complaint may generally proceed when the respondent failed to take timely and appropriate action or did not respond within 15 calendar days from receipt of your written notice. Exceptions may apply under the NPC Rules, including circumstances requiring urgent action, so do not delay seeking help when harm is continuing or safety is at risk.

Prepare the formal complaint

Use the current NPC Complaint-Affidavit or complaint-assisted form. The NPC announced that a new Complaint-Affidavit template took effect on 1 July 2025, so do not rely on an older saved form.

The complaint must ordinarily be verified or notarized and accompanied by:

Evidence of the privacy violation.
Proof that the respondent received your prior written notice.
The respondent’s answer, if any.
Witness affidavits where relevant.
Documents identifying the lender, app operator, and data processor.
A clear statement of the relief requested.

The NPC may dismiss a complaint that is deficient in form, lacks supporting information, does not involve a privacy violation, fails to give the respondent an opportunity to address the matter, or names parties who cannot be identified or traced despite diligent effort.

Check the NPC’s current complaint-filing instructions and forms before submission. The official filing guidance permits filing personally, by registered mail, by courier, or through electronic means authorized by the Commission. Do not assume that an informal email alone is a properly filed formal complaint. The NPC’s published complaint mechanics explain the documentary and formatting requirements.

A complaint may be filed by the affected data subject or by an authorized representative. A representative ordinarily needs a special power of attorney; additional authority documents apply when a juridical entity acts as representative.

If the lender is BSP-supervised

Some digital loans are provided by banks, non-bank electronic-money issuers, or other institutions supervised by the BSP rather than an SEC-regulated lending company.

First file through the institution’s Financial Consumer Protection Assistance Mechanism or customer-service complaint channel. Ask for a reference number and written resolution. If dissatisfied with its action, escalate through the BSP Consumer Assistance Mechanism:

BSP Online Buddy: use the BOB icon on the BSP website or the BSP’s official Facebook page.
Email: send the completed Complaint/Inquiry/Reply form and proof of your first-level complaint to consumeraffairs@bsp.gov.ph.
Telephone: (02) 5306-2584 or (02) 8708-7087.

The BSP’s current consumer-assistance guide confirms that complaining first to the supervised institution is the required first-level recourse.

A privacy complaint may still be filed with the NPC even when the lender is BSP-supervised. The regulatory routes address different issues and may proceed separately.

When to involve law enforcement

Regulatory complaints do not replace a criminal complaint. Promptly contact law enforcement when messages involve:

A credible threat of violence, abduction, sexual harm, property damage, or stalking.
Extortion or a demand for money backed by a threat to publish private information.
Impersonation of police, prosecutors, courts, or government agencies.
Hacking, account takeover, identity theft, or unauthorized transactions.
Publication of falsified documents or seriously defamatory online material.
Continued harassment that creates an immediate safety risk.

Bring the device containing the original evidence, a government-issued ID, printed and digital copies, the incident timeline, and information identifying the sender and lender.

Official reporting options include the NBI Online Complaint page and the NBI Cybercrime Division. The NBI’s published procedure for investigative assistance to victims of computer crimes provides for a complaint form, preliminary interview, sworn statement, and submission or examination of relevant devices and documents. Cybercrime incidents may also be reported through the channels listed by the Department of Justice Office of Cybercrime.

The exact offense depends on the words used, intent, method of communication, people who received the material, and available evidence. A threatening or embarrassing message is not automatically a particular crime; let investigators or counsel assess the facts under the Revised Penal Code, the Cybercrime Prevention Act, the Data Privacy Act, and other applicable laws.

What remedies may be available

Depending on the evidence and the regulator’s jurisdiction, possible outcomes may include:

An order to stop or correct unlawful personal-data processing.
Removal, blocking, erasure, or correction of personal data when legally justified.
Administrative sanctions, fines, suspension, or revocation affecting the lender or its data-processing registration.
Referral for criminal investigation or prosecution.
Civil damages where the legal requirements and proof of injury are established.
Regulatory action against the lender or its collection service provider.

No agency can guarantee a particular outcome. Criminal penalties under the Data Privacy Act apply only when the statutory elements are proved through the proper proceedings; they should not be quoted as an automatic consequence of every privacy complaint.

Common mistakes that weaken a complaint

Deleting the app or messages before preserving them.
Naming only the app and not attempting to identify its corporate operator.
Submitting cropped screenshots that omit the sender, date, or surrounding conversation.
Sending a general accusation without a timeline or specific acts.
Failing to attach proof of the prior written privacy complaint required by the NPC.
Using an obsolete NPC form or submitting an unverified narrative as though it were a formal complaint.
Exaggerating, editing evidence, or identifying a collector without a factual basis.
Posting the collector’s personal information publicly in retaliation.
Ignoring authentic court papers because the collector previously sent fake-looking threats.
Paying through an unverified personal account or link.
Assuming a complaint automatically suspends payment obligations or court deadlines.
Secretly recording private calls without first checking the Anti-Wiretapping Act and obtaining legal advice.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

You receive an authentic summons, subpoena, complaint, warrant, or court order.
Private photographs, identification documents, medical information, or financial records have been published.
The harassment includes a credible threat, stalking, extortion, or physical confrontation.
Your employer or clients are being repeatedly contacted and your livelihood is affected.
The lender claims a balance you did not borrow or an account opened through identity theft.
Money was taken from your bank or e-wallet account without authority.
You need an injunction, damages, a criminal complaint, or representation in an administrative proceeding.
A filing or response deadline is approaching.

Verify purported court documents directly with the court named in them. Do not rely on a phone number or link supplied by the collector.

Frequently asked questions

Can an online lender contact everyone in my phone?

No. Unbridled or excessive processing of a contact list is prohibited. For debt collection, the amended NPC rules prohibit contacting people in the borrower’s contact list other than persons properly named as guarantors. Limited access may be used to let a borrower choose a character reference or guarantor, but it is not blanket authority to harvest and message the entire address book.

Can a lender call my character reference to collect from them?

A character reference may be contacted for identity and information verification within the limits of the NPC rules. The reference is not automatically a guarantor and should not be pressured to pay. A guarantor must have separately and expressly agreed to that role.

Is public shaming allowed if I really owe the money?

No. The existence of a debt does not authorize public humiliation, malicious disclosure, or excessive processing of personal data. The lender must use lawful collection methods.

Does filing a complaint erase my loan?

No. A regulatory or privacy complaint concerns the lender’s conduct. A valid principal obligation may remain enforceable, subject to the contract and applicable law. Request an itemized statement and address payment or dispute issues separately.

Can a collector have me arrested simply for failing to pay?

Ordinary nonpayment of a civil debt does not by itself authorize arrest. Fraud, issuance of a worthless check under circumstances covered by law, or another separately established offense may present different issues. A collector cannot create a criminal case merely by sending a threatening message.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers if necessary for safety or well-being, while keeping one controlled written channel for legitimate account communications if appropriate.

Can my relative or co-worker file a complaint too?

Yes, if their own personal data was misused or they personally received harassment, they may have an independent basis to complain. They should preserve their own evidence. Filing on another person’s behalf generally requires proper written authority.

May I file with both the SEC and NPC?

Yes, when the facts involve both unfair debt collection and unlawful personal-data processing. A police or NBI report may also be appropriate where potentially criminal conduct is involved. Explain in each filing that related complaints were submitted elsewhere and provide their reference numbers.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rights, procedures, and the proper forum depend on the lender’s identity, the documents, and the specific communications involved. Official sources and filing channels were checked as of 2 September 2026.