Quick answer

Preserve the evidence, stop unnecessary app access, notify the lender in writing, and report each violation to the agency that handles it:

Report abusive or unfair collection by a lending or financing company—including its collection agency—to the Securities and Exchange Commission (SEC) through the SEC iMessage portal.
Report unlawful access, use, retention, or disclosure of personal data to the National Privacy Commission (NPC) using its formal complaint process.
Report threats, fraud, extortion, impersonation, account compromise, or similar possible crimes promptly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.
If there is an immediate threat to life or safety, call Unified 911 or go to the nearest police station.

One incident may justify reports to several agencies. For example, messaging your employer about your debt may involve both unfair collection and unlawful disclosure. Reporting harassment does not automatically cancel a valid loan, but owing money does not give a lender the right to threaten, shame, or misuse personal data.

What online lenders are prohibited from doing

Philippine law permits reasonable efforts to collect a legitimate debt. It does not permit abusive collection or unlimited use of the borrower’s phone data.

The March 18, 2026 joint advisory of the DICT, NPC, and SEC expressly identifies harassment, intimidation, public shaming, unlawful use of personal data, threats of violence or other criminal means, threats to take action that cannot legally be taken, and collection-related contact with people other than the borrower’s guarantor as prohibited conduct. These rules apply to online lending platforms operated by recorded or unrecorded entities. See the official DICT-NPC-SEC Advisory on Online Lending Platforms.

Depending on the evidence, reportable conduct may include:

Threatening physical harm, property damage, arrest, deportation, workplace action, or another consequence the collector has no legal power to impose.
Sending degrading, intimidating, or public-shaming messages.
Posting the borrower’s name, photograph, identification document, loan details, or fabricated “wanted” material online or in group chats.
Messaging relatives, friends, co-workers, employers, clients, or other phone contacts to demand payment when they are not guarantors.
Treating a character reference as automatically liable for the loan.
Using the borrower’s photograph, contacts, social-media connections, or other personal data to embarrass or pressure the borrower.
Requiring or retaining unnecessary access to contacts, photographs, storage, camera, location, or other protected phone resources.
Continuing to process data after its legitimate purpose has ended, without another lawful basis.
Using a collection agency to do something that the lender itself is prohibited from doing.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, requires fair and respectful treatment, prohibits abusive collection or debt-recovery practices, and requires financial service providers to protect client data. A provider remains responsible for its employees and agents and may be solidarily liable with an accredited third-party service provider for collection-related acts.

The SEC’s more specific rule for lending and financing companies is SEC Memorandum Circular No. 18, series of 2019.

Contact lists, character references, and guarantors are not the same

The distinction matters:

A character reference is provided to verify the borrower’s identity and the truthfulness of information given during the application. A character reference is not automatically responsible for the debt.
A guarantor expressly agrees to answer for the borrower’s obligation if the borrower defaults. The lender must obtain the guarantor’s separate consent in accordance with the law on guaranty and data protection.
For debt collection, the lender may contact the guarantor. It may not use the borrower’s contact list to pursue people who were not named and did not consent as guarantors.

An app may be given limited contact-list access to let a borrower select a reference or guarantor, or to derive proportionate metadata for a legitimate purpose. That is not permission to copy the entire list and use it for harassment. Unconstrained, excessive, or disproportionate processing is prohibited under NPC Circular No. 2022-02, which amended the original loan-data guidelines in NPC Circular No. 2020-01.

A character reference who is contacted must be told that they were named as a reference and how their details were obtained. They must also be given the option to have their personal data removed as a reference. Contacting them for debt collection, marketing, cross-selling, or unrelated product offers is prohibited unless a separate lawful basis applies.

Consent is not a blank check

Tapping “Allow” or accepting an app’s terms does not legalize every later use of personal data.

Under the Data Privacy Act of 2012, personal data must be processed transparently, for a legitimate and declared purpose, and only to a proportionate extent. Consent, where relied upon, must be freely given, specific, informed, and evidenced by written, electronic, or recorded means.

Online lenders must provide understandable information about:

What data will be collected.
Why and how it will be used.
Who may receive it.
How long it will be kept.
Whether profiling, automated decision-making, or credit scoring is involved.
How the borrower can exercise data-subject rights or contact the lender’s data protection officer.

Permissions should be requested only when the information becomes necessary. Camera or gallery access may be appropriate for identity or payment verification, but the permission should be disabled—or the borrower prompted to revoke it—after that purpose is fulfilled. A photograph obtained for verification may not be repurposed for shaming.

The lender remains accountable even if a collection agency, technology provider, or overseas contractor processes the data.

What to do immediately

1. Preserve evidence before blocking, revoking access, or uninstalling

Save evidence in its original form where possible:

Complete screenshots of texts, chat threads, emails, social-media posts, and app notifications.
The sender’s number, account name, profile URL, email address, and payment instructions.
Dates and times of calls or messages.
Call logs and voicemails.
Screenshots or screen recordings of the app’s permissions, privacy notice, developer name, app-store listing, and version.
The loan agreement, disclosure statement, repayment schedule, account statement, receipts, and proof of prior payments.
Messages sent to relatives, employers, co-workers, or other contacts.
Written statements or screenshots from those contacts showing what they received.
Copies of complaints sent to the lender and all replies.
Proof that an online post was public, including its URL, group name, posting account, date, and visible audience.
Any medical, employment, or financial records showing resulting harm, if relevant to the relief you may seek.

Keep an untouched copy. Do not crop away the sender, timestamp, URL, or surrounding conversation. Export chats when the platform allows it.

Do not secretly record a private voice conversation without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Preserving call logs, written messages, and voicemails left for you does not require creating a new secret recording.

2. Secure the phone and accounts

After preserving evidence:

Revoke unnecessary access to contacts, storage, camera, location, microphone, and photographs.
Change passwords that were reused elsewhere and enable multi-factor authentication.
Review email, social-media, and e-wallet accounts for unfamiliar logins or recovery changes.
Tell affected contacts not to click links, provide information, or send money to collectors.
Uninstall the app if it is no longer needed, but only after saving the evidence and account records.
Report the app and abusive accounts to the relevant app store or platform. This is supplemental and does not replace an official complaint.

Revoking permission stops future device access but cannot retrieve data that the operator may already have copied.

3. Identify the actual company

The app’s brand may differ from the legal name of the lender, financing company, or collection agency. Look for the operator’s legal name in:

The loan agreement and disclosure statement.
The privacy notice and terms of service.
The app-store developer information.
Receipts, account statements, payment instructions, and collection messages.
SEC registration or certificate-of-authority information.

A company’s SEC registration alone does not necessarily authorize it to operate as a lending or financing company. Include every known brand, corporate name, collection agency, phone number, and account in the report. If the operator cannot be identified, describe the steps taken to identify it and provide the app listing and payment details.

Send a written complaint to the lender

A written complaint creates a clear record and is generally required before a formal NPC complaint.

Send it to the company’s consumer-assistance unit, official customer-service channel, data protection officer, or registered contact address. State:

Your name and account or loan reference, revealing only what is necessary.
The date, sender, and exact conduct complained of.
Who received the disclosure or collection message.
What personal data was accessed, used, or disclosed.
Why the recipient was not a guarantor, if applicable.
The action requested: stop the contact, preserve relevant records, remove a post, restrict unlawful processing, correct inaccurate data, identify the collection agency, provide a data-access response, or investigate the incident.
A reasonable request for written confirmation and a substantive response.

For NPC purposes, keep proof that the company received the notice. Under the NPC’s rules, a complainant ordinarily must show that the respondent was informed in writing and failed to take timely or appropriate action, or did not respond within 15 calendar days from receipt. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

Do not include passwords, PINs, one-time passwords, or full payment-card credentials.

File an unfair-collection complaint with the SEC

For a lending company, financing company, online lending platform, or its collection agency, submit the complaint through the SEC iMessage portal. The SEC’s Financing and Lending Companies Department may also be reached through the 1-4732 (1-4SEC) hotline, as stated in the 2026 joint advisory.

Provide:

The app name and legal company name, if known.
The collector or agency’s name and contact details.
A chronological account of the conduct.
The loan and payment documents needed to understand the relationship.
Copies of the abusive messages, posts, call logs, and third-party communications.
The names or descriptions of people contacted and whether any of them separately consented as guarantors.
Your prior written complaint and the company’s response.
The specific action you want the SEC to consider.

The SEC can investigate regulatory violations and impose administrative measures. It does not automatically cancel the loan, rewrite payment terms, or erase a valid debt merely because a complaint was filed.

File a privacy complaint with the NPC

Use the NPC route when the complaint concerns the collection, copying, access, use, retention, sharing, posting, or other processing of personal data.

Required preliminary step

Ordinarily, notify the company or responsible entity in writing and allow it to act. If there is no response within 15 calendar days from receipt, or the response is not timely or appropriate, proceed with the formal complaint. Explain and prove any reason the NPC should waive this step because urgent intervention is necessary.

Formal complaint requirements

The NPC’s official filing page provides the current complaint form. A formal complaint generally must:

Be written, signed, verified, and notarized.
Identify the complainant and respondent, or provide facts that may lead to an unknown respondent’s identification.
Narrate the material facts clearly and chronologically.
State the relief requested.
Attach relevant documents and witness affidavits, when available.
Attach all correspondence with the respondent and describe the action taken.
Include the required certification against forum shopping.
Include a special power of attorney if a representative files for the data subject, subject to the special rules for minors and persons who cannot act for themselves.

The complaint may be submitted in person, by courier, or as a scanned email filing through the channel shown on the NPC filing page. The current NPC contact page lists (+63) 2 5322-1322, locals 114 or 115, for complaints.

Under the current NPC schedule of fees, the basic complaint filing fee is ₱500, plus the applicable legal research fee and any additional fee for a damages claim. Qualified indigent litigants and government entities may be exempt if they submit the required proof. Confirm the current amount and payment instructions before paying.

If the unlawful processing must be stopped urgently

A complainant may apply for a temporary ban on processing personal data when filing the complaint or before the NPC decision becomes final. The motion must establish the factual and legal basis for urgent relief. A summary hearing and a bond may be required unless an exemption applies. Because an application for a temporary ban suspends the main complaint while the application is resolved, legal advice can be important before choosing this remedy.

The governing procedure appears in the 2021 NPC Rules of Procedure, as amended by NPC Circular No. 2024-01.

Report threats, fraud, or other suspected crimes

Regulatory complaints do not replace a criminal report when there are threats, extortion, fraud, impersonation, hacking, stalking, or danger to a person or property.

The 2026 joint advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

For an immediate or life-threatening emergency, call Unified 911.

Give law enforcement the original threats, sender and account information, payment demands, URLs, transaction records, and any facts showing the person’s ability or attempt to carry out the threat. Avoid confronting the sender or arranging an in-person meeting without police guidance.

The investigating authorities and prosecutors—not the collector or borrower—determine which criminal law may apply.

If the lender is supervised by another regulator

Most independent lending companies, financing companies, and online lending platforms are regulated by the SEC. The route may differ when the service is operated by another type of institution:

For a bank, digital bank, e-money issuer, or other BSP-supervised institution, complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, escalate through the BSP Online Buddy or the other channels on the BSP Consumer Assistance page. The BSP lists consumeraffairs@bsp.gov.ph as an alternative when the consumer cannot use the chatbot.
For a cooperative offering credit, use its consumer-assistance process and, when necessary, the Cooperative Development Authority’s applicable financial-consumer procedure.
Regardless of the financial regulator, an unlawful processing-of-personal-data complaint may still fall within NPC jurisdiction.

A collector cannot order your arrest for an ordinary unpaid debt

The 1987 Constitution states that no person shall be imprisoned for debt. A collector cannot create an arrest warrant, send police merely by declaring a borrower “wanted,” or truthfully claim that nonpayment alone guarantees imprisonment.

This does not mean every dispute involving a loan is immune from criminal investigation. Separate conduct—such as alleged fraud or another independently punishable act—must be assessed under its own elements. A lender may also pursue lawful civil remedies. Never ignore a genuine court summons, subpoena, or official notice; verify it directly with the issuing court or agency and seek legal advice.

What reporting can lead to

Depending on the proven violation and the agency’s jurisdiction, possible outcomes include:

An order to stop or restrict unlawful data processing.
Removal, blocking, correction, or lawful disposal of personal data.
Regulatory fines or other administrative sanctions.
Suspension or revocation of authority to operate.
Indemnity or other relief in an NPC proceeding when legally supported.
Referral to the Department of Justice or law-enforcement authorities.
Criminal prosecution when the required elements and responsible persons are established.

Not every rude message proves a Data Privacy Act crime. Criminal liability for unauthorized processing, processing for unauthorized purposes, malicious disclosure, or unauthorized disclosure depends on the data involved, the lawful basis, the purpose, the responsible person, and other statutory elements. The penalties under the Data Privacy Act vary by offense and may include imprisonment and substantial fines.

A willful violation of the Financial Products and Services Consumer Protection Act may be punished by one to five years’ imprisonment, a fine of ₱50,000 to ₱2 million, or both, subject to prosecution and judgment by a court. Separate administrative sanctions may also apply.

For actions or claims under that Act, the statutory period is generally five years from consummation of the financial consumer transaction, or five years from discovery of deceit or nondisclosure of material facts, with an outside limit of ten years from the violation. Other claims may have different periods. Do not treat this as a universal deadline for every SEC, NPC, civil, or criminal remedy; act promptly and obtain advice if significant time has passed.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Posting unredacted IDs, loan agreements, phone numbers, or contact lists publicly while asking for help.
Secretly recording private calls without checking the Anti-Wiretapping Act.
Sending only emotional conclusions instead of a dated, factual chronology.
Naming only the app brand and not the legal company or collection agency.
Filing with one agency when the incident involves both unfair collection and privacy misuse.
Assuming a character reference is a guarantor.
Assuming that accepting app permissions authorized public shaming or contact-list harassment.
Paying through an unfamiliar personal account without verifying the lender and official payment channel.
Sharing PINs, passwords, one-time passwords, or full card credentials with a collector or supposed government investigator.
Ignoring a genuine court document because earlier collection threats were fake.
Assuming a complaint automatically suspends payment obligations or cancels the loan.

When legal help is urgent

Speak with a Philippine lawyer, the Public Attorney’s Office if eligible, or another accredited legal-aid provider promptly when:

A threat identifies your home, workplace, children, or daily movements.
Intimate images, government IDs, medical information, or financial credentials were disclosed.
The lender has compromised or attempted to take over an account.
The harassment has caused job loss, serious medical harm, or a credible risk of violence.
A public post is spreading rapidly and urgent restraint may be needed.
You are considering an NPC temporary-ban application or a civil damages claim.
You received a summons, subpoena, warrant, or pleading from a court or government office.
A substantial amount is disputed or the documents show conflicting lenders, assignments, or payment records.
The incident occurred long ago and prescription may be an issue.

Frequently asked questions

Can an online lender contact my family, friends, or employer?

For debt collection, the lender may contact a person who separately consented as a guarantor. It may not pursue arbitrary phone contacts, relatives, co-workers, employers, or character references merely because their information appeared in the borrower’s phone. Preserve the message and report it to the SEC and, where personal data was misused, the NPC.

Can a character reference be forced to pay?

Not merely because they were listed as a reference. A guarantor must expressly bind themselves to answer for the obligation and give separate consent. The actual documents and circumstances still need to be reviewed if the lender claims that a guaranty was signed.

Does granting contact permission allow the app to message everyone?

No. Contact access must remain necessary, proportionate, transparent, and connected to a legitimate purpose. Unbridled processing and using contacts outside named guarantors for debt collection are prohibited.

Can I complain if I am not the borrower?

Yes, if your own personal data was processed or you were affected by the privacy violation, you may be a data subject entitled to complain to the NPC. You may also preserve the collection message and assist the borrower’s SEC complaint. Your standing and the correct respondent will depend on the facts.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers, but consider keeping one written official channel open for account statements, dispute resolution, and proof of the company’s response. Do not continue an unsafe exchange merely to collect more evidence.

Does filing a complaint stop interest or collection?

Not automatically. Continue to request an accurate written account and address any undisputed lawful obligation through verified channels. Regulatory or court relief is needed to alter legal rights or stop particular conduct.

What if the app or company is unregistered?

Report it to the SEC anyway and include the app-store page, developer details, loan documents, payment accounts, phone numbers, and advertisements. The NPC loan-data rules also cover persons acting as lenders whether or not they obtained the required SEC authority.

Can the lender still sue for collection?

A lender may pursue lawful civil remedies if it has a valid claim. Harassment and privacy violations do not necessarily extinguish the underlying debt. Conversely, the existence of a debt does not excuse unlawful collection.

Where should I report first?

If personal safety is at risk, contact 911 or law enforcement first. Otherwise, preserve evidence and notify the lender in writing. File with the SEC for unfair collection, with the NPC for personal-data misuse, and with law enforcement for threats, fraud, or other suspected crimes. These steps may proceed in parallel when appropriate.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. The correct remedy may depend on the loan documents, the lender’s legal identity, the data processed, the exact communications, and the relief sought. Laws, procedures, fees, and official channels were checked against primary and official government sources as of August 18, 2026.