Quick answer

You may report an online lending app to more than one authority because harassment, unlawful debt collection, privacy violations, threats, and fraud involve different laws:

Report unfair or abusive collection by a lending or financing company to the Securities and Exchange Commission (SEC) through SEC iMessage. Select “Complaints on Financing and Lending Companies.”
Report unlawful access, use, retention, or disclosure of personal data to the National Privacy Commission (NPC). Ordinarily, first notify the lender or its data protection officer in writing and allow appropriate action; if there is no response within 15 calendar days, or the response is inadequate, file an NPC complaint. The NPC may waive this requirement in serious or urgent cases.
Report credible threats, extortion, account hacking, impersonation, fraud, or other apparent crimes to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. Call 911 if anyone is in immediate danger.
If the lender is a bank, digital bank, e-wallet provider, or another institution supervised by the Bangko Sentral ng Pilipinas, complain first to the institution and then escalate an unresolved complaint through the BSP Consumer Assistance Mechanism.

A real unpaid loan does not give a collector permission to threaten, insult, publicly shame, or indiscriminately contact people in your phone. At the same time, reporting misconduct does not automatically cancel a valid debt. Preserve the evidence, secure your accounts, and address the collection conduct and the loan balance as separate issues.

What conduct may violate the law?

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, prohibits abusive collection or debt-recovery practices and protects financial consumers’ rights to fair treatment, data privacy, disclosure, and timely complaint handling.

For SEC-regulated lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices. Conduct worth reporting may include:

threats of violence or other criminal means against you, your family, your reputation, or your property;
threats to take an action that cannot legally be taken;
insults, obscenities, profanity, or degrading and humiliating language;
false claims that the collector is a lawyer, police officer, court employee, government official, or authorized representative when that is untrue;
false claims that a criminal case, warrant, court order, or government action already exists;
public shaming, including posting or circulating your name, photograph, loan information, identification documents, or edited “wanted” material;
contacting employers, coworkers, relatives, friends, or other people merely to embarrass or pressure you;
communicating at unreasonable or inconvenient times;
using deceptive means or communicating false credit information; and
continuing abusive collection through an outside collection agency.

A creditor may send factual payment reminders, demand payment, negotiate a settlement, report credit information when authorized by law, or bring a lawful civil action. Those acts are not automatically harassment. The problem is the manner, content, timing, audience, truthfulness, and legality of the collection conduct.

The Constitution prohibits imprisonment merely for debt. This does not prevent a separate criminal investigation when the facts independently support an offense such as fraud. A collector may not use that distinction to falsely threaten immediate arrest over an ordinary unpaid loan.

Privacy rules for online lending apps

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate. A lender must have a lawful basis for processing data and may not collect or use more information than reasonably necessary.

The rules specifically applicable to loan transactions are found in NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02. The DICT, NPC, and SEC reiterated these rules in their 18 March 2026 joint advisory on online lending platforms.

Access to contacts is not a blank check

An app may obtain limited access necessary to let you select a character reference or guarantor, or may derive proportionate metadata for a specified legitimate purpose. It may not engage in unrestrained, excessive, or disproportionate processing of an entire contact list.

In particular:

A character reference is provided only to verify the borrower’s identity and the truth of information given in the application. A character reference cannot automatically be treated as a guarantor or contacted to collect the debt.
A guarantor must separately and expressly consent to undertake the obligation. For debt collection, the lender may contact a valid guarantor.
Contacting other people taken from the borrower’s phone, email, or social-media contacts for debt collection is prohibited.
Photos obtained for identity verification, know-your-customer checks, fraud prevention, or payment verification cannot be used to shame or harass a borrower.
Permissions must be suitable, necessary, and not excessive. Once their purpose has been fulfilled and no other lawful basis remains, the app should turn them off or prompt the user to revoke them.
Personal data may be retained only as long as necessary for the original purpose, a legitimate legal claim, or a period required by law. It cannot be kept indefinitely for an undefined future use.

Clicking “Allow” or accepting terms does not authorize harassment. Consent must be informed and specific, and processing must still comply with necessity, proportionality, and the declared purpose. Deceptive interfaces—such as pre-ticked permissions or designs that make consent easy but withdrawal difficult—may undermine valid consent.

What to do immediately

1. Preserve evidence before blocking or uninstalling the app

Capture evidence while it remains available:

screenshots showing the complete message, sender, date, and time;
the collector’s phone number, email address, social-media profile, username, and profile URL;
screen recordings showing the message thread, post, or app permissions;
call logs and any voicemails;
original emails, including their headers where available;
the app’s store listing, developer name, privacy notice, terms, and permission requests;
the loan agreement, disclosure statement, repayment schedule, receipts, and account ledger;
proof of payments and any disputed charges;
copies of posts, group chats, or messages sent to your contacts;
written statements or screenshots from relatives, coworkers, or friends who were contacted;
the legal name of the lender, collection agency, and payment recipient; and
a chronological incident log stating what happened, when, through which channel, and who received the communication.

Keep original files. Avoid editing, cropping, annotating, or repeatedly forwarding the only copy. Back up the evidence to a secure location.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Saving voluntarily sent voice messages and documenting the call’s time, number, and your recollection is safer.

2. Reduce further access

After preserving evidence:

revoke the app’s access to contacts, camera, photos, microphone, location, storage, and other unnecessary permissions;
change passwords for email, social media, cloud storage, and financial accounts if compromise is possible;
enable multifactor authentication;
review logged-in devices and terminate unfamiliar sessions;
warn affected contacts not to pay, click links, provide codes, or disclose information to the collector; and
report unauthorized financial transactions immediately to the bank or payment provider.

If the app was installed from an unofficial source or you suspect malware, obtain qualified technical help before resetting the device so that important evidence is not accidentally destroyed.

3. Send a written complaint to the lender

Send the complaint to the company’s consumer-assistance unit and data protection officer, if identified in its app or privacy notice. Use email or another channel that creates proof of delivery.

State:

your name and account or loan reference;
the app and company involved;
the collector’s name, number, or account;
the specific messages, disclosures, contacts, or permissions being challenged;
when each incident occurred;
which personal data was accessed or disclosed;
the corrective action you want; and
that all relevant electronic records must be preserved.

You may request that the company stop contacting third parties, stop public disclosure, correct false information, identify the data source and recipients, restrict unlawful processing, remove data no longer lawfully needed, and provide its written findings.

Do not include passwords, PINs, one-time passwords, or complete card details.

How to file with the SEC

For a lending company, financing company, online lending platform, or its collection agency:

Go to SEC iMessage.
Open a new ticket and sign in using an eSECURE account.
Choose “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.
Identify both the app’s trade name and the company’s full legal name. Include the collection agency if known.
Attach the loan documents, valid government-issued ID, incident chronology, screenshots, messages, call logs, payment records, and communications with the company.
If different companies are involved, prepare a separate complaint for each respondent.
Save the ticket number and monitor the portal for requests, replies, or additional-document deadlines.

The current SEC iMessage user guide explains ticket creation and status tracking. The SEC’s March 2026 advisory also lists hotline 1-4732 (1-4SEC) for unfair debt-collection concerns.

Check the lender’s claimed authority through Check with SEC. Ordinary SEC corporate registration alone does not necessarily mean that the company has a valid Certificate of Authority to operate as a lending or financing company. If the lender appears unregistered, revoked, suspended, or is using an undisclosed app, mention that in the complaint and attach what you found.

The SEC can investigate and impose regulatory sanctions. A standard complaint does not by itself cancel the loan, rewrite its terms, or declare the contract or interest provision void. Republic Act No. 11765 gives the SEC adjudicatory authority over certain purely civil claims for payment or reimbursement not exceeding ₱10 million, but such relief requires the appropriate adjudicatory proceeding—not merely an assumption that an iMessage ticket will produce a monetary award.

How to file with the National Privacy Commission

First satisfy the 15-day written-notice rule

Under the 2021 NPC Rules of Procedure, an NPC complaint ordinarily must show that:

you informed the lender, collector, or other responsible entity in writing about the privacy violation; and
it failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving your notice.

Attach your notice, proof of delivery, and the response, if any.

The NPC may waive this requirement for good cause or a serious violation—for example, when immediate action is needed to prevent grave and irreparable harm, the respondent cannot provide an adequate remedy, or the conduct is patently illegal. If you seek a waiver, state the reasons and supporting facts clearly rather than simply omitting the prior notice.

Prepare the formal complaint

Use the NPC’s current 2026 Complaint-Affidavit form, or prepare a verified complaint that meets the Rules.

The filing should include:

the complainant’s and respondent’s identifying and contact information;
a clear chronological narration;
the specific personal data processed or disclosed;
how the data was obtained and used;
why the processing was unauthorized, excessive, or outside the declared purpose;
the relief requested;
correspondence showing exhaustion of remedies;
documentary evidence and witness affidavits, when available;
a valid government-issued ID;
verification under oath; and
a certification against forum shopping.

If you later learn that the same or a similar claim has been filed elsewhere, the Rules require disclosure to the NPC within five calendar days.

A contact whose information was harvested or who received collection messages may file as a data subject even if that person was not the borrower. If a representative files for someone else, a special power of attorney is ordinarily required.

Filing channels and fees

The NPC accepts complaints personally, by registered mail, by accredited courier, or by email when authorized by the Commission. Its current office is:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City 1103

The NPC lists complaints@privacy.gov.ph, telephone (02) 5322-1322 local 114 or 115, and mobile numbers 0970-818-0555 and 0905-506-1478 for complaint concerns on its contact page. Confirm the current submission and payment instructions before filing electronically. Under the Rules, electronic pleadings must be digitally signed and submitted in PDF format when practicable.

The current base complaint filing fee is ₱500, plus the applicable legal research fee and any additional fee for a damages claim. Indigent complainants may seek exemption by submitting the documents required by NPC Circular No. 2023-01.

The investigating officer should give the complaint due course or dismiss it without prejudice within 30 calendar days from receipt. This is an initial evaluation period, not a guarantee that the entire case will finish within 30 days.

If unlawful publication or data processing is continuing and likely to cause grave harm, ask the NPC or a lawyer about a temporary ban or cease-and-desist relief. These remedies have separate requirements and may involve a hearing, filing fee, and bond.

Reporting threats, fraud, and other possible crimes

Regulatory complaints do not replace an urgent police or criminal complaint.

The March 2026 DICT-NPC-SEC advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Bring or attach the original messages, account details, URLs, transaction records, identification of possible suspects, and your incident chronology. If there is an immediate or credible threat to life, safety, or property, call 911 or go to the nearest police station.

Do not pay a supposed “police,” “court officer,” or “lawyer” merely to prevent an immediate arrest. Verify any claimed case directly with the named court or agency. Never ignore a genuine summons, subpoena, or court notice; obtain legal advice promptly.

If the lender is supervised by the BSP

The SEC route is generally for lending and financing companies. If the credit provider is a bank, digital bank, credit-card issuer, electronic-money issuer, or another BSP-supervised financial institution:

File first through the institution’s Financial Consumer Protection Assistance Mechanism.
Keep its complaint reference number and written response.
If unresolved, use the BSP Online Buddy on the BSP website, or submit the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph.
Attach the complaint sent to the institution, its reply, supporting documents, and the resolution requested.

A cooperative lender is generally regulated by the Cooperative Development Authority, although the NPC still has jurisdiction over privacy violations.

Common mistakes that weaken complaints

Deleting the app, messages, or account before preserving evidence.
Naming only the app and not identifying the company operating it.
Sending a general allegation such as “they harassed me” without exact dates, words, recipients, numbers, or screenshots.
Filing with the NPC without written prior notice or without explaining why the 15-day requirement should be waived.
Submitting edited screenshots that hide dates, sender details, or surrounding context.
Secretly recording calls without considering the Anti-Wiretapping Act.
Posting IDs, contracts, phone numbers, or intimate details publicly while asking social media for help.
Combining unrelated respondents in one SEC complaint.
Ignoring portal notices or deadlines for supplemental documents.
Assuming that reporting harassment automatically erases the principal, interest, or other lawful obligation.
Paying a collector through a personal account without verifying that the recipient is authorized and that the payment will be credited to the loan.
Signing a settlement, waiver, or acknowledgment containing terms you do not understand.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if you qualify, or an appropriate legal-aid organization promptly when:

threats involve violence, sexual material, kidnapping, or harm to children;
intimate images, government IDs, medical information, or financial credentials have been published;
the collector is impersonating law enforcement or demanding money to stop an arrest;
a lawsuit, summons, subpoena, or formal demand has been received;
your identity or accounts have been used for unauthorized loans or transactions;
you want damages, an injunction, or emergency NPC relief;
several companies or foreign operators are involved;
the lender is trying to make you sign a waiver or settlement; or
the facts may involve fraud or another criminal allegation separate from the debt.

Frequently asked questions

Can an online lender contact everyone in my phone?

No. Unrestrained processing of a contact list is prohibited. For debt collection, the lender may contact a person who separately consented to be a guarantor. A character reference is for identity and information verification, not debt collection.

I allowed contact access when I installed the app. Does that make the messages lawful?

Not necessarily. Permission must relate to a specified, legitimate, necessary, and proportionate purpose. App access does not authorize public shaming, harassment, or debt-collection messages to unrelated contacts.

Can my employer or coworkers be told about the debt?

Using them to pressure or embarrass you can constitute unfair collection and unlawful disclosure. The result may differ if the person is a valid guarantor, a disclosure is legally required, or another specific lawful basis applies.

Can I demand immediate deletion of all my data?

You may request blocking, removal, or destruction of unlawfully obtained, unauthorized, inaccurate, or no-longer-necessary data. However, the lender may retain information still needed to service an existing loan, comply with law, or establish, exercise, or defend a legal claim. It must identify a lawful purpose and may not retain data indefinitely for an undefined future use.

Does filing a complaint stop collection?

Not automatically. You may request that unlawful methods stop, but the lender may continue lawful collection of a valid obligation. Keep debt negotiations in writing and ask for a complete statement of account.

Can the collection agency blame the lender, or vice versa?

Outsourcing does not remove the lender’s responsibility for personal data under its control. Republic Act No. 11765 also makes a financial service provider solidarily liable with an accredited third-party service provider for relevant acts or omissions, including debt collection, subject to the facts and the law governing the provider.

What if I cannot identify the real company?

Preserve the app-store page, developer details, privacy notice, payment accounts, phone numbers, website registration information, and messages. Report the matter to the SEC and law-enforcement authorities. An NPC complaint may describe facts that could lead to the respondent’s identity, but inability to identify or trace a respondent despite diligent efforts can affect whether the complaint proceeds.

Will the collector go to jail after I file with the NPC or SEC?

Not automatically. These agencies investigate and observe due process. Administrative sanctions, civil remedies, or criminal referral depend on the evidence and the elements of the applicable offense. Criminal liability is determined through the proper prosecutorial and court process.

Primary and official references

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the contract, communications, identity of the lender, evidence, and requested relief. Official sources and procedures were checked as of 18 August 2026.