Quick answer

You can report an online lending app to more than one agency because harassment and misuse of personal data may involve separate violations:

Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission (SEC).
Report unauthorized access, disclosure, or misuse of personal information to the National Privacy Commission (NPC).
If the lender is a bank, digital bank, electronic-money issuer, or another BSP-supervised institution, first complain to the provider and then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).
Report threats of violence, extortion, impersonation, account hacking, or other possible crimes promptly to the police, the PNP Anti-Cybercrime Group, or the NBI Cybercrime Division. Call 911 if anyone is in immediate danger.

Harassment does not erase a valid loan, but owing money does not authorize a lender or collection agent to threaten, shame, deceive, or expose you to your contacts. Keep paying only through verified official channels and separately dispute unlawful collection conduct.

What conduct should be reported?

A lender may send lawful payment reminders and use reasonable, legally permissible collection methods. The line is crossed when collection becomes abusive, deceptive, threatening, or unnecessarily exposes personal information.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices by covered financing and lending companies—and collection agencies acting for them—include conduct such as:

Threatening violence, physical harm, damage to property, or harm to a person’s reputation;
Threatening an action that cannot legally be taken;
Using insults, obscenities, or profane language;
Falsely claiming to be a police officer, lawyer, court employee, government official, or another person;
Using false representations or deceptive means to collect or obtain information;
Publicly disclosing or publishing a borrower’s personal information, subject to narrow lawful exceptions;
Communicating loan information to people in the borrower’s contact list who are not guarantors or co-makers; and
Using collection communications at times or places that the lender knows are inconvenient, subject to the circular’s stated qualifications.

Examples worth documenting include a collector posting “wanted” graphics, altered photographs, loan balances, identification documents, or accusations of criminality; messaging officemates, relatives, social-media friends, or an employer to shame the borrower; and threatening immediate arrest without a lawful basis.

Ordinary nonpayment of a private loan does not by itself allow a collector to arrest you. A collection message may truthfully say that the creditor is considering lawful proceedings, but it should not falsely present a demand letter as a court order or claim that a warrant already exists when none does.

Privacy rules for lending apps

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality. Borrowers also have rights concerning access, correction, objection, erasure or blocking in appropriate cases, damages, and complaints.

For loan-related processing, NPC Circular No. 2022-02 specifically provides that:

An app must not demand unnecessary or excessive permissions.
Access to protected resources such as contacts, the camera, or photo gallery must be suitable, necessary, and proportionate to a legitimate purpose.
Consent should be obtained when the particular data becomes necessary, with an accessible notice explaining its use.
Camera or gallery access allowed for identity verification, fraud prevention, or payment verification should be limited to the relevant stage. A borrower’s photograph must not be used to harass or embarrass the borrower.
Unconstrained or excessive processing of a contact list—including processing that leads to harassment or debt collection outside permitted guarantors—is prohibited.
The interface should let the borrower select references or guarantors with only the minimum contact-list access necessary.
A character reference may be contacted to verify the borrower’s identity or information, but may not automatically be treated as a guarantor.
A guarantor must separately consent to that legal role. For debt collection, the lender may not contact other people merely because their details appear in the borrower’s contact list.

A privacy notice or a borrower’s tap on “Allow contacts” is not a blank cheque. Whether particular processing was lawful still depends on what information was collected, what the notice said, the purpose, necessity, proportionality, retention, security, and any valid consent or other lawful basis.

What to do immediately

1. Preserve evidence before blocking or uninstalling the app

Save the original material wherever possible:

Full screenshots and screen recordings showing the sender, number, account name, date, time, and surrounding conversation;
Text messages, emails, call logs, voicemail, social-media posts, comments, and profile links;
Messages received by relatives, coworkers, references, or other contacts;
The app’s name, developer, store listing, download link, privacy notice, terms, and permission screens;
Loan agreement, disclosure statement, account number, payment schedule, receipts, and demand letters;
Names used by collectors, callback numbers, payment accounts, QR codes, and email addresses;
Proof that a photograph, ID, balance, or accusation was sent to third parties;
Your written complaint to the lender or its data protection officer and proof of delivery; and
The lender’s response—or proof that it did not respond.

Ask affected contacts to preserve their own copies. Record a short chronology identifying what happened, when it happened, who received each disclosure, and how you learned about it. Do not edit screenshots in a way that removes context; make redacted duplicates for sharing while retaining untouched originals.

Philippine law has rules governing electronic evidence. Keeping original files, device records, URLs, account identifiers, and an orderly timeline can make later authentication easier.

2. Secure your accounts and device

After preserving evidence:

Revoke unnecessary contacts, camera, microphone, location, storage, and photo permissions in the device settings.
Change passwords for email, social media, banking, and e-wallet accounts if compromise is possible.
Enable multi-factor authentication and review logged-in devices.
Notify contacts that unauthorized or misleading collection messages may be sent in your name.
Report abusive posts or impersonation accounts to the platform, but save the evidence first.
Contact your bank or e-wallet immediately if credentials, one-time passwords, or unauthorized transactions are involved.

Revoking app permissions limits future access but may not delete information already copied. Send the lender a written request asking what data it holds, where it came from, to whom it was disclosed, and—where legally available—for correction, blocking, erasure, or cessation of unlawful processing.

3. Continue addressing the account through verified channels

Request an itemized statement showing principal, interest, fees, payments, and the claimed balance. Communicate through the lender’s official customer-assistance channel, not an unverified number supplied by a collector.

Do not send money to a personal account merely because someone threatens arrest or public exposure. Verify the company, loan, collector, and payment instructions independently. If you dispute the balance, say so clearly in writing and identify the entries you contest.

How to complain to the lender first

Send a concise written complaint to the company’s customer-assistance unit and data protection officer. Include:

Your name and account or application reference;
The app and legal company names, if known;
Dates and a factual description of the conduct;
The collector’s numbers, usernames, or claimed identity;
The personal data used or disclosed and the recipients;
Copies of key evidence;
The remedy requested; and
A request for a written response and preservation of relevant records.

Possible requests include stopping contact with third parties, removing unlawful posts, restricting collection communications to you or your authorized representative, identifying the company and collection agency involved, correcting inaccurate records, and investigating the data disclosure.

Do not include passwords, PINs, one-time passwords, or unrelated identity documents. Redact information about innocent third parties unless it is necessary to establish the complaint.

How to file with the National Privacy Commission

Use the NPC route when contacts, photographs, identification documents, account details, device data, or other personal information were accessed, used, retained, or disclosed improperly.

Ordinarily, the NPC’s complaint mechanics require you to:

Inform the lender, its data protection officer, processor, or other concerned entity in writing about the alleged privacy violation.
Allow it an opportunity to act.
File with the NPC if it fails to take timely or appropriate action or does not respond within 15 calendar days after receiving your written notice.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal action. Explain and support the urgency if you seek a waiver; do not simply omit the earlier written complaint.

For a formal case, use the current Complaints-Assisted Form available on the NPC forms page. The NPC’s filing instructions call for a completed, notarized form or properly verified complaint, supporting evidence, and any witness affidavits. Pay attention to the required verification and certification against forum shopping.

The NPC currently lists personal, registered-mail, courier, and authorized electronic filing. Its complaint page directs scanned submissions to complaints@privacy.gov.ph, while specifying requirements for electronic documents. Check the page immediately before filing because formats, fees, technical requirements, and channels can change.

If continued processing creates grave or irreparable harm, review the NPC’s procedure for an application for a temporary ban on processing. This is a formal remedy with additional requirements and is not automatically granted.

How to file with the SEC

Use the SEC route for unfair debt collection by an SEC-regulated lending company, financing company, online lending platform, or its collection service provider. The company remains accountable under SEC rules even when collection is outsourced.

Submit the complaint through the SEC iMessage portal or the complaint channel currently designated by the SEC. The BSP’s official regulator directory also lists the SEC Financial and Lending Company Division at flcd_complaints@sec.gov.ph and (02) 8818-5990 for lending complaints.

Include:

The app name and the lender’s complete corporate name;
The company’s SEC registration or certificate-of-authority details, if available;
Your account reference and relevant loan documents;
A chronological account of each prohibited act;
Collector and third-party collection-agency details;
Screenshots, recordings, links, and witness messages;
Proof of disclosure to contacts or the public; and
The action you want the SEC to consider.

An app’s brand name may differ from the corporation operating it. Identify both where possible. Report the app even if you cannot find a registration record; state that its legal identity or authority is uncertain rather than guessing.

Regulatory complaints can support investigation and sanctions, but filing one does not automatically cancel the debt, delete a credit record, award damages, or stop a separate collection case.

When the BSP is the correct regulator

Some loan products delivered through apps come from banks, digital banks, credit-card issuers, electronic-money issuers, or other BSP-supervised financial institutions rather than ordinary SEC-regulated lending companies.

For these providers:

File a formal complaint through the institution’s own consumer-assistance mechanism.
Keep the complaint reference and response.
If unresolved or handled inadequately, escalate through the BSP Consumer Assistance Mechanism.

The BSP currently accepts escalation through its Online Buddy and lists consumeraffairs@bsp.gov.ph for the Complaints, Inquiries and Requests form. Attach your complaint to the institution, its reply if any, supporting documents, contact information, and the resolution requested.

The controlling regulator depends on the licensed entity that actually supplied the credit—not merely the app, payment gateway, or e-wallet used to receive or repay it.

When to report to law enforcement

Seek prompt law-enforcement help if messages involve:

A credible threat of physical harm;
Extortion or a demand for money backed by a threat to expose private material;
Stalking or publication of your home or workplace details;
Hacking, identity theft, account takeover, or unauthorized transactions;
Impersonation of police, courts, lawyers, or government agencies;
Fabricated sexual images or other highly damaging content; or
Conduct targeting a child or another vulnerable person.

Go to the nearest police station, the PNP Anti-Cybercrime Group, or the NBI Cybercrime Division with the device and preserved evidence. Ask for a complaint or incident reference. Call 911 when danger is immediate.

The precise criminal offense depends on the words used, intent, method, surrounding facts, and available proof. Avoid assuming that every rude message constitutes the same crime. A prosecutor or lawyer should assess possible offenses under the Revised Penal Code, the Cybercrime Prevention Act, the Data Privacy Act, or other applicable laws.

Common mistakes that weaken a complaint

Deleting the app, messages, or posts before making copies;
Submitting cropped screenshots that omit sender details, dates, or context;
Naming only the app brand and not the legal lender;
Accusing the wrong company because a payment processor or collector used a different name;
Filing an NPC case without first notifying the responsible entity in writing or explaining why the requirement should be waived;
Omitting notarization, verification, required attachments, or the certification against forum shopping;
Paying an unverified personal account to stop threats;
Posting your own IDs, loan documents, phone numbers, or contacts publicly while asking for help;
Treating a character reference as automatically liable for the loan;
Assuming a complaint suspends payment obligations or pending court deadlines; and
Ignoring an authentic summons because previous collection messages were fake.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive an authentic summons, subpoena, court order, or formal agency pleading;
Private or intimate material has been published or threatened with publication;
The lender disclosed data involving a child, health condition, government ID, financial account, or another sensitive matter;
Harassment is continuing despite written notice;
You need emergency injunctive relief or a temporary ban on data processing;
There is a credible physical threat, stalking, job loss, or serious reputational harm;
Money was taken through unauthorized transactions or identity theft;
You are considering a civil claim for damages; or
Complaints involving the same facts are pending before several courts or agencies.

If private counsel is unaffordable, ask the Public Attorney’s Office whether you meet its legal-assistance requirements or inquire with an accredited legal-aid organization. For immediate safety concerns, prioritize law enforcement and personal safety over completing regulatory paperwork.

Frequently asked questions

Can a lender contact my family or employer?

A lender may have a legitimate reason to contact a properly designated guarantor or to locate a borrower through lawful, proportionate means. It may not use unrelated contacts to shame you, broadcast the debt, or pressure them to pay. A character reference is not automatically a guarantor, and NPC rules prohibit contacting people from the borrower’s contact list for debt collection unless they were validly named and consented as guarantors.

Is accessing my contacts automatically illegal?

Not necessarily. Limited access may be permitted for a lawful, necessary, and proportionate purpose, with proper notice and an applicable legal basis. Unbridled access, copying the full contact list, or using contacts for harassment and collection outside valid guarantors is prohibited.

Can collectors post my name, photograph, ID, or balance online?

Public shaming and unnecessary disclosure of borrower information can violate SEC collection rules and data-privacy law. Preserve the post, URL, account details, audience, comments, and timestamps before requesting removal.

Does harassment cancel my loan?

No. A valid debt and unlawful collection conduct are separate issues. You may challenge the harassment while requesting an accurate statement, disputing improper charges, negotiating payment, or continuing valid payments through official channels.

Can I complain if I was only a contact or character reference?

Yes, if your own personal data was processed or you personally received harassment. Your NPC complaint should focus on the misuse of your information and your own rights. Preserve the message and record how the sender obtained or claimed to have obtained your number.

Should I report the collection agency or the lender?

Identify both. Under SEC rules, using a third-party collector does not allow the covered lender or financing company to avoid responsibility for collection conduct performed on its behalf.

Can I file with the SEC and NPC at the same time?

Potentially, yes, because the agencies address different regulatory issues. Disclose other related proceedings when a form or certification requires it, and keep the factual account consistent. Seek legal advice if you are also pursuing damages or a criminal case.

How quickly must I file?

Do not delay. Evidence may disappear, platform records may be overwritten, and different civil, criminal, administrative, or contractual claims may have different time limits. The NPC’s ordinary pre-filing rule includes the 15-calendar-day response period described above, but that is not a general limitation period. Obtain case-specific advice if substantial time has passed.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and legal consequences depend on the lender’s regulatory status, the documents, and the evidence. Official sources and filing channels were checked on September 3, 2026.