Quick answer

Report abusive collection by an online lending app to the Securities and Exchange Commission (SEC). Report unauthorized access, use, or disclosure of personal data to the National Privacy Commission (NPC). If there are credible threats, extortion, stalking, identity theft, fabricated posts, or danger to you or another person, report immediately to the police or the NBI Cybercrime Division; you do not have to wait for the SEC or NPC.

Before blocking numbers or deleting the app, preserve the messages, call logs, app permissions, loan documents, payment records, and proof that relatives, co-workers, or other contacts were approached. Send the lender or its data protection officer a written complaint. For an NPC complaint, the general rule is that the lender must first be informed in writing and given up to 15 calendar days from receipt to respond or take timely appropriate action. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm.

Harassment or a privacy violation does not automatically cancel a valid loan. You may still owe the lawful balance, but the lender and its collectors must use lawful, fair, and proportionate collection methods.

What collection conduct may be unlawful

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited unfair collection practices include:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name or personal information to shame the borrower, except where disclosure is specifically allowed by law or the SEC rules.
Communicating information known, or which should be known, to be false—including failing to say that a debt is disputed when communicating about it.
Pretending to be a court, government officer, law-enforcement agent, or another person, or using other false or deceptive collection methods.
Contacting people in the borrower’s phone list who were not named as guarantors or co-makers. The SEC rule treats this as unfair even if the borrower supposedly consented to contact-list access.
Ordinarily contacting the borrower before 6:00 a.m. or after 10:00 p.m. The circular contains exceptions when the account has been past due for more than 15 days or the borrower expressly agreed, through written, electronic, or recorded means, that those are the only reasonable contact times. Those exceptions do not permit threats, public shaming, deception, or misuse of personal data.

A lender may send lawful payment reminders, demand payment, negotiate a restructuring, engage a legitimate collection agency, contact a true guarantor or co-maker, and pursue a proper civil case. Firm collection is not automatically harassment. The issue is the collector’s words, timing, audience, representations, use of data, and overall conduct.

Privacy rules specific to lending apps

The Data Privacy Act of 2012 requires personal data processing to be transparent, based on a lawful ground, for a legitimate declared purpose, and proportionate to that purpose. Consent is not the only possible lawful ground, but a loan agreement is not unlimited permission to harvest, publish, or weaponize personal information.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

Lending apps must not demand unnecessary or excessive permissions.
Accessing or saving phone, email, or social-media contact lists for harassment or unfair collection is prohibited.
Camera access may be used for a legitimate know-your-customer purpose, but a borrower’s photograph must not be altered, posted, or used to embarrass the borrower.
Borrowers must receive accessible information explaining what data will be collected and how it will be used.
An app should prompt the user to disable a permission when its purpose has already been completed and no other lawful basis remains.
A character reference is not automatically a guarantor. The reference must be told how the lender obtained the contact information and must be offered a way to have it removed as a character reference.
A guarantor must have separately consented to that role. For collection, the lender may not contact other people in the borrower’s contact list merely because the app obtained access to them.
Marketing, cross-selling, or sharing data for unrelated products requires an appropriate separate lawful basis.

Data-subject rights include requesting information and access, correcting inaccurate data, objecting where applicable, and seeking the blocking, removal, or destruction of data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary. These rights are subject to lawful retention duties and data genuinely needed to establish, exercise, or defend legal claims.

Preserve evidence before taking protective action

Save evidence in its original form wherever possible:

Take full-screen screenshots showing the message, sender, date, time, and surrounding conversation. Avoid relying only on cropped images.
Export chats, emails, call logs, voicemails, and recordings lawfully obtained on your device. Back them up outside the phone.
Keep an incident log listing each call or message, the number or account used, what was said, who received it, and the action taken.
Ask contacted relatives, co-workers, employers, or friends to preserve their own screenshots and call logs. A short signed statement or affidavit may later help establish what they personally received.
Save the app-store page, developer name, website, privacy notice, permission screen, advertisements, corporate name, SEC registration number, and Certificate of Authority number shown in the app.
Keep the loan agreement, disclosure statement, account statement, disbursement proof, payment receipts, collection notices, and any computation of interest, fees, and penalties.
Preserve proof of every complaint sent to the lender: email headers, delivery or read receipts, ticket numbers, courier receipts, and the lender’s reply.
Capture public posts before requesting takedown. Save the exact URL, account name, date, and visible audience or comments.

After preserving evidence, revoke unnecessary contacts, camera, storage, microphone, location, and social-media permissions. Change passwords if the app or collector may have obtained account access, enable multi-factor authentication, and report exposed posts to the platform. Do not delete the only copy of the app or messages until the relevant evidence has been secured.

Send a written complaint to the lender first

Use the lender’s official customer-service channel and, if available, its data protection officer or privacy email. Identify the corporate lender as well as the app and collection agency.

State:

Your name, account or loan reference, and safe contact details.
The dates, numbers, accounts, and exact conduct complained of.
Which people were contacted and what loan or personal information was disclosed.
Which data or device permissions appear to have been accessed.
Whether you dispute the debt or only particular charges—and the basis of any genuine dispute.
The relief requested, such as stopping third-party contacts, stopping threats or publication, correcting the account, identifying the collector, providing an account statement, taking down posts, and blocking or deleting unlawfully processed data subject to lawful retention.
A request to preserve collection logs, call recordings, access logs, instructions to collection agents, and other relevant records.
A request for written acknowledgment and a substantive response.

Keep the language factual. Do not threaten, insult, exaggerate, or admit an amount you genuinely dispute. The written complaint is important evidence and generally satisfies the first step required before the NPC will act.

File the SEC complaint

For a lending or financing company, including its online platform and collection agency:

Check the company—not merely the app name—through the SEC’s Check with SEC service linked from the SEC online-services page. Look for both corporate registration and authority to operate as a lending or financing company. Presence in an app store is not proof of SEC authority.
Open the SEC iMessage ticketing system and create a ticket.
Select Financing and Lending Companies Department, then Complaints on Financing and Lending Companies. The current SEC public user guide explains account access, ticket creation, attachments, replies, and status tracking.
Identify the app, corporate lender, collection agency, collector names or aliases, phone numbers, URLs, and available registration or authority numbers.
Describe the conduct chronologically and attach the strongest evidence. Include the loan documents and the complaint previously sent to the lender.
Save the electronic ticket number and monitor the ticket for requests for clarification or additional documents.

Report an app that appears unregistered even if the amount involved is small. Do not assume that an unregistered operator’s demand is accurate, but do not independently conclude that registration problems automatically extinguish a private obligation. Obtain legal advice before making that determination.

File the NPC privacy complaint

Use the NPC process when the app or collector accessed, disclosed, retained, altered, or used personal data unlawfully—for example, by harvesting contacts, sending debt information to co-workers, posting an ID or photograph, impersonating the borrower, or refusing to address an unauthorized disclosure.

First satisfy the 15-day rule

Under the 2021 NPC Rules of Procedure, as amended, a complaint ordinarily will not be given due course unless:

You informed the lender, collection agency, or other responsible entity in writing about the violation; and
It failed to take timely appropriate action, or did not respond within 15 calendar days from receiving your written notice.

The NPC may waive these requirements for properly alleged and proven good cause or a serious violation, including grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. Explain and document the reason if waiting would expose someone to serious harm.

Prepare and submit the complaint

Download the latest Complaint-Affidavit from the NPC’s formal-complaint page.
Complete it accurately, including the respondent’s identity, the personal data involved, a chronological narration, requested relief, and all related proceedings.
Attach the written notice to the respondent, proof of receipt, any response, a valid government-issued ID, and the supporting evidence.
Complete the verification and certification against forum shopping. The complaint must be notarized.
Submit it personally or by courier to the NPC, or scan and email it to complaints@privacy.gov.ph, following the instructions on the official complaint page. Keep proof of submission.
If another case involving the same or similar issues is later filed or discovered, the NPC rules require the complainant to report that fact within five calendar days.

The current NPC fee schedule lists a ₱500 base complaint filing fee, a legal research fee of at least ₱10, and additional fees when damages are claimed. Confirm the assessment and official payment instructions with the NPC; do not pay through an unofficial account. Qualifying indigent complainants may seek exemption. The published criteria generally require both family gross income not exceeding twice the applicable monthly minimum wage and no real property with a fair market value above ₱300,000, supported by the specified barangay certification, affidavits, and available tax declaration.

If the lender is a bank or another BSP-supervised institution

Some credit apps are operated by banks, digital banks, or other institutions supervised by the Bangko Sentral ng Pilipinas rather than an ordinary SEC-regulated lending company.

First complain through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. If the response is unsatisfactory or the institution fails to act within a reasonable period, escalate through the BSP Consumer Assistance Mechanism, normally using the BSP Online Buddy.

The BSP itself advises that complaints about ordinary financing companies, lending companies, online lending platforms, and their collection agencies are best directed to the SEC. A privacy complaint may still be filed separately with the NPC when personal data was misused.

Report threats or possible crimes immediately

Go to the nearest police station or approach the NBI Cybercrime Division when the facts involve:

A specific or credible threat of physical harm.
Extortion or a demand backed by threats to publish data, images, or fabricated allegations.
Stalking or collectors appearing at a home, workplace, or school in a threatening manner.
Identity theft, account takeover, impersonation, or falsified documents.
Altered, sexualized, or defamatory photographs.
Unauthorized access to online accounts or devices.
Threats against children, elderly family members, or other vulnerable people.

Bring the device if safe, together with printed and digital copies of the evidence, identification, and a chronological incident summary. Ask for the complaint, report, or reference number. A police or NBI complaint can proceed while SEC and NPC complaints are pending because the agencies perform different functions.

The Constitution provides that no person may be imprisoned merely for debt. That does not prevent legitimate civil collection, and it does not protect separate criminal conduct such as fraud or issuing a bouncing check when the legal elements are present. A collector cannot lawfully guarantee arrest or claim that a criminal case already exists when it does not.

Common mistakes to avoid

Deleting the app, messages, or social-media posts before preserving them.
Reporting only the app’s marketing name and omitting the corporate lender or collection agency.
Writing only “I was harassed” without identifying the exact words, time, sender, recipient, and disclosure.
Assuming that tapping “Allow Contacts” authorized public shaming or unrestricted third-party collection.
Treating a character reference as a guarantor without a separate undertaking.
Paying a collector’s personal wallet or newly supplied bank account without verifying it through the lender’s official channel.
Borrowing from another app merely to stop abusive calls.
Retaliating by publishing a collector’s personal data, making threats, or sending abusive messages.
Ignoring genuine court papers. Verify them directly with the named court and seek legal assistance promptly.
Concealing related complaints or cases when an agency form requires disclosure.
Assuming that harassment automatically erases the principal loan and all lawful charges.

When legal help is urgent

Seek a Philippine lawyer promptly if personal data or intimate images have been posted, a collector has made a credible threat, the lender alleges fraud, you received a subpoena or summons, several agencies or companies are involved, the app’s corporate identity cannot be determined, or you intend to claim substantial damages.

Under the Financial Products and Services Consumer Protection Act, the SEC and BSP may adjudicate certain purely civil financial-transaction claims when the relief sought is solely payment or reimbursement of money not exceeding ₱10 million. Privacy damages, injunctions, criminal complaints, and other remedies have different procedures and requirements. A lawyer can help identify the correct respondents, causes of action, deadlines, and forum.

Frequently asked questions

Can a lending app contact my family or employer?

It may contact a genuine guarantor or co-maker consistently with that person’s undertaking and applicable law. A mere character reference is not automatically liable. Contacting relatives, co-workers, or an employer to reveal the debt, shame you, pressure them to pay, or damage your reputation may violate SEC and privacy rules.

What if I allowed the app to access my contacts?

That is not blanket permission to harvest the list or use it for harassment. SEC rules treat contacting list members who were not identified as guarantors or co-makers as unfair notwithstanding supposed consent. NPC rules also require processing to remain necessary, proportionate, transparent, and connected to a lawful purpose.

Can someone contacted by the app file a complaint?

Yes. A relative, co-worker, or other person whose own contact information was obtained or used may be an affected data subject and may file an NPC complaint. That person should preserve the message, number, date, and proof showing how the lender connected them to the borrower.

Should I stop paying after filing a complaint?

Not solely because a complaint was filed. Continue to protect your position by requesting a verified statement of account, disputing unsupported charges in writing, and paying only through authenticated channels. Filing a complaint does not by itself suspend or cancel a valid debt.

Are screenshots enough?

They are useful but stronger when accompanied by the original device or files, complete message threads, metadata, call logs, URLs, witness evidence, loan records, and proof linking the sender to the lender or collection agency.

Should I report to both the SEC and NPC?

Often, yes. The SEC addresses lending authority and unfair collection; the NPC addresses misuse of personal data. Police or NBI involvement may also be appropriate when the conduct is potentially criminal. Disclose related proceedings whenever an agency form asks for them.

What if the app keeps changing numbers?

Preserve each number and message. Group them in a dated incident log and identify repeated language, payment instructions, account references, or links connecting them to the same lender. Do not engage merely to obtain more abuse.

Official sources

This article provides general legal information, not legal advice or a prediction of the outcome of any complaint. Rights, liability, and the correct forum depend on the loan documents, the lender’s regulatory status, the specific communications, and available evidence. Official sources and procedures were checked as of 6 August 2026.