Harassment by an online lending app can quickly become overwhelming, especially when collectors threaten arrest, send insulting messages, contact relatives or coworkers, or post a borrower’s photo online. Philippine law allows legitimate lenders to collect unpaid debts, but it does not allow them to use threats, public shaming, deception, excessive access to phone contacts, or other abusive methods. The correct reporting route depends on what happened: the Securities and Exchange Commission handles unfair collection by lending and financing companies, the National Privacy Commission handles misuse of personal data, and law-enforcement agencies handle threats, extortion, impersonation, and other possible crimes.

When Online Lending Collection Becomes Harassment

A lender may lawfully:

Remind you that payment is due.
Send a statement of account or demand letter.
Explain interest, penalties, and available payment arrangements.
Contact a guarantor or co-maker who legally agreed to answer for the loan.
File a civil collection case if the debt remains unpaid.
Endorse the account to a legitimate collection agency.

Collection becomes potentially unlawful when the lender or collector uses intimidation, humiliation, deception, or personal information unrelated to legitimate collection.

Collection Practices Prohibited by SEC Rules

Under Securities and Exchange Commission Memorandum Circular No. 18, Series of 2019, financing companies, lending companies, and their collection agents must use reasonable and lawful means when collecting debts. Prohibited practices include:

Using or threatening violence or other criminal means against a borrower, the borrower’s reputation, or property.
Threatening legal action that the collector cannot lawfully take.
Using insults, obscenities, profanity, or abusive language.
Publicly disclosing or publishing the borrower’s name or personal information to shame the borrower.
Giving false information about the debt.
Pretending to be a lawyer, court employee, police officer, government official, or another person.
Using fake court documents, arrest notices, subpoenas, warrants, or criminal complaints.
Contacting people in the borrower’s phone contact list who are not guarantors or co-makers.
Calling or messaging at unreasonable hours, generally before 6:00 a.m. or after 10:00 p.m., subject to the limited exceptions stated in the circular.

A lending company cannot avoid liability by blaming its collection agency. Under the SEC circular, third-party collectors act as agents of the lender, and the financing or lending company remains ultimately responsible for their conduct. Collectors should also disclose their true identity and the company they represent.

Misuse of Contacts, Photos, and Other Personal Data

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal information to be collected and used for a lawful, declared, and proportionate purpose. An online lending app should not collect more data than reasonably necessary for processing and administering the loan.

National Privacy Commission rules specifically prohibit online lenders from harvesting, copying, or using a borrower’s phone contacts, email contacts, or social-media connections for debt collection or harassment. An app must not use a borrower’s photograph to embarrass or publicly shame the borrower. Permissions requested by the app must be necessary and proportionate to the stated purpose.

A person named as a character reference does not automatically become a guarantor. The lender may verify information with a properly declared reference, but it cannot demand that the reference pay the debt unless that person separately and knowingly agreed to become a guarantor or co-maker. NPC rules also require transparency toward character references and provide a mechanism for them to request removal of their information. (National Privacy Commission)

Examples of Conduct That May Be Reportable

The following commonly reported practices may justify a complaint:

Sending your contacts a message saying you are a scammer, thief, or criminal.
Creating a group chat containing relatives, coworkers, or friends to shame you.
Editing your photograph to make a “wanted,” “fraud,” or funeral-style poster.
Posting your name, identification card, address, or loan balance on Facebook or another platform.
Threatening to have you arrested merely because the loan is unpaid.
Claiming that a police operation, court warrant, or immigration hold order already exists when it does not.
Repeatedly calling your employer and disclosing the debt.
Demanding payment from a character reference who never signed as guarantor.
Threatening physical harm, sexual violence, property damage, or harm to family members.
Using different numbers to send hundreds of messages after you have already acknowledged the account.
Accessing contacts, photographs, location information, or files that were unnecessary for the loan.
Continuing to use data after the borrower or reference has raised a valid privacy objection.

One incident may fall under more than one agency. For example, sending threats to your relatives using contacts copied from your phone may support an SEC complaint for unfair collection, an NPC complaint for unlawful processing of personal information, and a police or NBI report concerning the threats.

Can You Be Arrested for Not Paying an Online Loan?

The Philippine Constitution states that no person may be imprisoned for debt. A genuine inability or failure to pay a loan is ordinarily a civil matter, not a crime. The lender may demand payment, charge lawful amounts, negotiate a settlement, or file a civil case, but a debt collector cannot issue an arrest warrant. (Lawphil)

The Supreme Court has also explained that merely failing to repay money received as a loan does not, by itself, amount to estafa through misappropriation. In Gabionza v. Court of Appeals, G.R. No. 161057, September 12, 2008, the Court distinguished a debtor-creditor relationship from situations involving property held in trust or under an obligation to return the same thing. (Lawphil)

This does not mean borrowers can never face criminal liability. A separate crime may exist where there was actual fraud from the beginning, falsification, identity theft, or another independently punishable act. But a collector’s blanket statement that “you will be arrested tomorrow for nonpayment” is generally misleading and may itself be evidence of unfair collection.

Reporting harassment also does not erase a valid debt. Keep the collection issue separate from questions about the correct principal, interest, penalties, and payment schedule.

Where to Report Harassment by an Online Lending App

Where to report	Appropriate situations	Important point
Securities and Exchange Commission	Threats, insults, public shaming, contacting unrelated persons, false legal claims, unreasonable collection hours, or misconduct by a lending company or collection agency	This is usually the main regulator for lending companies, financing companies, online lending platforms, and their collectors.
National Privacy Commission	Unauthorized access to contacts, use of photos for shaming, disclosure of loan information, excessive app permissions, or unlawful processing of personal data	The complaint normally requires a notarized complaint-affidavit, supporting evidence, and proof of identity.
PNP Anti-Cybercrime Group, NBI Cybercrime Division, or local police	Credible threats, extortion, stalking, impersonation, fake warrants, hacking, doxxing, or other possible crimes	Seek immediate police assistance when safety is at risk.
Bangko Sentral ng Pilipinas	The creditor is a bank, digital bank, e-money issuer, or another BSP-supervised financial institution	Complain first through the institution’s own consumer-assistance mechanism.
App store, social-media platform, or telecommunications provider	The app or account violates platform rules, publishes private information, impersonates authorities, or uses abusive numbers	Platform reports supplement, but do not replace, complaints to government agencies.

The name displayed in the app is not always the legal name of the creditor. Check the loan agreement, disclosure statement, privacy notice, payment instructions, app-store listing, and text messages to identify the corporation operating the platform.

How to Report Online Lending App Harassment Step by Step

1. Protect Yourself and Secure Your Accounts

When there is an immediate and credible threat of physical harm, contact 911 or the nearest police station. Tell trusted household members or workplace security if the collector has threatened to visit your home or office.

Then secure your device and accounts:

Change passwords for your email, social-media accounts, and financial apps.
Enable two-factor authentication.
Review the lending app’s permissions.
Revoke unnecessary access to contacts, photographs, location, storage, microphone, or camera after documenting the permissions.
Do not share your PIN, password, one-time password, card details, or account credentials with a collector or supposed investigator.

The BSP specifically warns financial consumers not to provide PINs, passwords, full account or card details, or similar credentials when making a complaint.

2. Preserve Evidence Before Blocking or Deleting Anything

Create one folder for all evidence. Preserve:

Screenshots showing the complete message, sender’s number or account, date, and time.
The original chat thread or exported conversation.
Call logs and saved voicemail messages.
Screenshots of posts, group chats, edited photographs, and comments.
Messages received by relatives, friends, employers, and coworkers.
The app’s name, icon, developer, app-store page, download link, and privacy policy.
Screenshots of every app permission.
The loan agreement, disclosure statement, repayment schedule, receipts, and payment history.
The amount actually released to you and the amount now being demanded.
Names used by collectors and the company they claim to represent.
Copies of fake warrants, summonses, demand letters, or government identification.
Any written complaint you sent to the lender and its response.
A chronological incident log listing what happened, when it happened, and who witnessed it.

Avoid relying only on cropped screenshots. Keep original electronic files and make a backup. Ask recipients of harassment messages to preserve their own copies and write a brief factual statement describing what they received.

Be careful about secretly recording telephone calls. Republic Act No. 4200, the Anti-Wiretapping Act, can make the secret recording of a private communication unlawful without the authorization required by law. Preserve text messages, voicemails, and call logs instead of covertly recording a live private conversation. (Lawphil)

3. Send a Written Complaint to the Lender

Send a concise written complaint to the lender’s official customer-service or data-protection contact. State:

Your name and loan-account reference.
The dates and forms of harassment.
The collector’s numbers, names, or accounts.
The personal data that was accessed or disclosed.
The people who were contacted.
What you want stopped or corrected.
That future communication should be made through lawful channels.

Do not admit to amounts you dispute. You may state that you are willing to discuss the correct account balance without accepting unlawful collection conduct.

This step creates a written record. For an NPC complaint, the current complaint form asks whether the respondent was contacted in writing and requires supporting correspondence when available. Where prior contact was unsafe or impractical, the form allows the complainant to explain why it was not done.

4. File a Complaint with the SEC

Use the SEC iMessage portal, the Commission’s official online inquiry and complaint system.

The general process is:

Sign in through the SEC’s eSECURE system.
Select Open a New Ticket.
Choose the service relating to the Financing and Lending Companies Department.
Select Complaints on Financing and Lending Companies.
Enter the lender’s corporate name, the app name, and all known details.
Describe the incidents chronologically.
Upload clear supporting files.
Submit the complaint and save the electronic ticket number.

SEC iMessage allows users to track the status of their ticket. The Commission’s user guide does not promise a single fixed resolution period for every lending complaint, so keep the ticket number and promptly answer requests for additional information.

Your narrative should identify the specific unfair acts rather than simply saying “the app harassed me.” For example:

On June 10, 2026, at 5:42 a.m., a collector using mobile number ______ sent my supervisor a message disclosing my loan and calling me a thief. My supervisor was not a guarantor or co-maker. Copies of the message, call log, loan agreement, and app-permission screen are attached.

5. File a Data Privacy Complaint with the NPC

Use the National Privacy Commission complaint page to obtain the current complaint form and submission instructions.

A formal NPC complaint generally requires:

A completed and notarized complaint-affidavit.
A valid government-issued identification document.
A detailed narration of the facts.
Copies of messages, screenshots, app permissions, posts, and other evidence.
Copies of your written communications with the lender, when available.
Witness affidavits when another person directly received or observed the harassment.
A Special Power of Attorney when filing through a representative.
Additional authority documents when a juridical entity files through a representative.

The NPC may dismiss an incomplete complaint or one unsupported by evidence. The current form expressly instructs complainants to attach the evidence relied upon.

A complaint may be filed personally, by registered mail, by courier, or through an electronic method authorized by the NPC. Electronic documents should generally be digitally signed and submitted in PDF form when practicable. The NPC’s Complaints and Investigation Division ordinarily has 30 calendar days to determine whether to give due course to a complaint or dismiss it without prejudice. The NPC states that the complete administrative process may take roughly 10 to 12 months, depending on the case. (National Privacy Commission)

As of the NPC’s current published fee schedule, the basic complaint filing fee is ₱500, plus the applicable legal research fee, with additional fees possible for certain claims or urgent applications. Qualified indigent litigants may apply for exemption by submitting the required proof of income, property, and indigency. Always check the current NPC page and form before filing because fees and procedural requirements may be updated.

6. Report Threats or Possible Crimes

Contact law enforcement when messages involve:

Credible threats of physical injury or death.
Threats against children or relatives.
Extortion or demands accompanied by threats.
Impersonation of police officers, NBI agents, lawyers, court personnel, or public officials.
Fake warrants, subpoenas, or criminal-case documents.
Hacking or unauthorized access to accounts.
Identity theft.
Publication of private information intended to expose you to danger.
Persistent stalking or coordinated online attacks.

Possible offenses will depend on the exact words and conduct. They may include grave threats, grave coercion, unjust vexation, oral defamation, libel, or other offenses under the Revised Penal Code. When committed through information and communications technology, Republic Act No. 10175, the Cybercrime Prevention Act, may also apply. Civil Code Articles 19, 20, 21, and 26 may support claims involving abuse of rights, unlawful injury, privacy, and interference with personal dignity. (Lawphil)

Reports may be made to:

The nearest police station.
The PNP Anti-Cybercrime Group.
The NBI Cybercrime Division.
The Cybercrime Investigation and Coordinating Center through its official reporting channels, including hotline 1326.
A prosecutor’s office when filing a formal criminal complaint supported by a sworn complaint-affidavit and evidence.

The BSP’s official complaint guide identifies the SEC as the proper regulator for online lending companies while listing the PNP Anti-Cybercrime Group, NBI Cybercrime Division, and CICC as relevant law-enforcement or cybercrime reporting channels.

A barangay blotter may help document an incident, particularly when collectors visit a residence, threaten a household, or create a disturbance. However, barangay proceedings do not replace an SEC or NPC complaint, and serious cybercrime or safety threats should be reported directly to police or the appropriate cybercrime unit.

7. Use the BSP Process Only When the Creditor Is BSP-Supervised

Some loans are offered inside an e-wallet or mobile application but are legally issued by a bank or another BSP-supervised financial institution. Identify the creditor named in the loan contract.

Under Republic Act No. 11765 and BSP rules, BSP-supervised institutions must not use abusive debt-recovery practices and must maintain a free consumer-assistance mechanism. The consumer ordinarily needs to complain first to the institution before escalating the matter to the BSP Consumer Assistance Mechanism.

Escalation may be made through the BSP’s online consumer channels or the current Complaint, Inquiry, or Request form. Complaints concerning ordinary financing companies, lending companies, online lending platforms, and their collection agencies should generally be directed to the SEC instead.

Documents, Fees, and Expected Timelines

Process	Main documents	Typical fee information	Timing reality
SEC iMessage complaint	Identification details, loan documents, lender/app information, screenshots, incident timeline, collector details	No filing fee is identified in the iMessage user guide for opening a complaint ticket	A ticket is generated electronically, but the guide does not state one fixed resolution period for all cases
NPC formal complaint	Notarized complaint-affidavit, valid ID, evidence, correspondence, witness affidavits, and authority documents when represented	Published basic filing fee of ₱500, legal research fee, and possible additional fees; qualified indigent litigants may seek exemption	Initial determination is ordinarily within 30 calendar days; the entire process may take about 10–12 months
Police, PNP ACG, NBI, or CICC report	Valid ID, complaint-affidavit or incident statement, screenshots, original files, URLs, account details, witness information	Making an incident report ordinarily has no filing fee, although notarization, printing, certification, or legal-document costs may arise	Urgent threats may be acted upon immediately; investigation and prosecution periods vary greatly
BSP consumer complaint	Proof of prior complaint to the institution, its response or ticket number, account records, and evidence	The institution’s consumer-assistance process and BSP escalation are free	Depends on the institution’s response and the complexity of BSP escalation

Government offices may require clearer copies, affidavits, certified records, or additional documents after initial review. Delays commonly occur when the complainant cannot identify the legal company behind the app, submits cropped or unreadable screenshots, omits the loan agreement, or fails to answer follow-up communications.

Common Mistakes That Weaken a Harassment Complaint

Deleting the App Too Early

Take screenshots of the app, account balance, privacy notice, developer information, permissions, and collection messages before uninstalling it. After preserving evidence and securing the account, you may revoke unnecessary permissions and remove the app if appropriate.

Identifying Only the Brand Name

An app may operate under a trade name different from the registered lending company. Include every available name, website, address, phone number, payment account, privacy-policy entity, and app-store developer.

Sending One Vague Complaint to Every Agency

Explain which conduct each agency should investigate:

SEC: abusive or unfair debt collection.
NPC: misuse or disclosure of personal information.
Police, NBI, or CICC: threats, extortion, impersonation, hacking, or other suspected crimes.
BSP: misconduct by a BSP-supervised institution after internal escalation.

Paying a “Clearance” or “Case Cancellation” Fee

Collectors sometimes claim that an extra payment will cancel an arrest warrant, remove a police record, or stop a court case. Verify the debt using the lender’s official channel. Do not send money to a personal account merely because someone threatens immediate arrest.

Sharing Sensitive Credentials

A legitimate investigator does not need your OTP, PIN, password, or complete card credentials to receive a complaint. Redact unnecessary financial details from attachments.

Retaliating Publicly

Avoid publishing the collector’s personal information, making unverified criminal accusations, or encouraging others to harass the collector. Preserve and report evidence through proper channels. Retaliatory posts can complicate the case and may expose the borrower to a separate complaint.

Assuming the Complaint Cancels the Loan

Continue reviewing lawful notices and keep records of payments. You may request a written breakdown of principal, interest, penalties, and payments without accepting abusive collection methods or waiving your complaint.

Common Online Lending Harassment Scenarios

The App Messaged Everyone in My Contacts

Preserve messages received by your contacts and obtain screenshots that show the sender, date, and complete text. File with the SEC for unfair collection and with the NPC for unauthorized access or use of contact information. A person appearing in your contact list is not responsible for your debt.

The Collector Called My Employer

Disclosure of a debt to an employer or coworkers for the purpose of shaming or pressuring the borrower may violate SEC collection rules and data-privacy requirements. Document who received the call, what was said, and whether the recipient was a guarantor or co-maker.

The Collector Says I Have an Arrest Warrant

Ask for the court, branch, case number, full case title, and date of issuance, but do not rely on documents sent by the collector. Independently verify any claimed case with the named court or law-enforcement agency. Preserve the message and report impersonation or fabricated documents where appropriate.

The App Is No Longer Available in the App Store

You may still report the operator. Include the old download link, screenshots, privacy policy, payment account, loan agreement, text numbers, email addresses, and any corporate name you can find. Removal from an app store does not eliminate potential regulatory or criminal liability.

The Loan Was Offered Through an E-Wallet

Check the contract rather than assuming the e-wallet is the lender. The creditor may be a bank, financing company, or separate lending corporation. The named creditor determines whether the primary complaint belongs with the BSP or SEC.

The Borrower Is an OFW or Lives Outside the Philippines

SEC iMessage can be accessed online. An NPC complaint may also be submitted through an authorized electronic method or through a representative. A representative generally needs a Special Power of Attorney, and documents signed abroad may be subject to the authentication requirements applicable to the agency and place of execution. Use the latest agency form before arranging notarization or authentication.

The Borrower Is a Foreigner

Philippine collection and privacy rules generally apply to lenders and processing activities operating within Philippine jurisdiction regardless of the borrower’s nationality. A foreign borrower should preserve Philippine loan records, identify the local lending company, and use the same SEC, NPC, BSP, or law-enforcement route appropriate to the conduct.

Frequently Asked Questions

Can an online lending app contact my family and friends?

It may communicate with an actual guarantor or co-maker about the guaranteed obligation. It should not mass-message people copied from your phone contacts or pressure ordinary friends and relatives to pay. A character reference is not automatically a guarantor.

Can a lending app post my picture because I did not pay?

No. NPC rules prohibit using a borrower’s photograph to harass, embarrass, or publicly shame the borrower. Public disclosure may also violate SEC collection rules and other civil or criminal laws, depending on the content.

Can I be arrested for an unpaid online loan?

Mere nonpayment of a debt does not ordinarily lead to imprisonment. A lender may pursue civil collection, but a collector cannot issue an arrest warrant. A separate criminal case would require an independently punishable act and proper legal proceedings.

Should I report first to the SEC or the NPC?

Report to the SEC when the main problem is abusive collection by a lending or financing company. Report to the NPC when personal data, contacts, photographs, or private loan information were unlawfully accessed or disclosed. Many cases justify filing with both agencies.

What if I do not know the company behind the app?

Submit all identifying information available: the app name and icon, app-store developer, website, privacy policy, loan agreement, payment recipient, bank or e-wallet account, collector numbers, and email addresses. Explain that the legal operator could not be confirmed.

Should I keep paying while the complaint is pending?

A harassment complaint does not automatically suspend or extinguish a valid loan. Pay only through verified official channels and request a written accounting if the balance is disputed. Keep receipts and do not pay invented “arrest cancellation” or “case clearance” charges.

Can I block the collector’s number?

After preserving the evidence, you may block abusive numbers. However, keep at least one lawful written channel open when possible so legitimate account notices and settlement proposals can be documented.

How long does an NPC complaint take?

The NPC states that its Complaints and Investigation Division ordinarily has 30 calendar days to decide whether to give due course to a complaint or dismiss it without prejudice. The complete administrative process may take approximately 10 to 12 months, depending on evidence, pleadings, hearings, and other case-specific factors. (National Privacy Commission)

Can I complain even if the harassment was done by a collection agency?

Yes. SEC rules cover third-party collection service providers, and the lending or financing company remains responsible for the acts of its collection agents.

What should I do if the threat appears immediate?

Contact 911 or the nearest police station, secure your household and accounts, preserve the threatening message, and report the incident to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Do not meet the collector alone or send money solely because of a threat.

Key Takeaways

A lender may lawfully collect a debt, but it cannot use threats, insults, deception, public shaming, or unauthorized contact harvesting.
File an SEC complaint for unfair collection by a lending company, financing company, online lending platform, or collection agency.
File an NPC complaint when contacts, photographs, loan information, or other personal data were unlawfully accessed or disclosed.
Report credible threats, extortion, impersonation, fake warrants, hacking, or stalking to the police, PNP Anti-Cybercrime Group, NBI, or CICC.
Use the BSP complaint process only when the creditor is a BSP-supervised financial institution, and complain to the institution first.
Preserve complete evidence before deleting the app, blocking numbers, or changing permissions.
Nonpayment of a loan alone does not ordinarily justify arrest or imprisonment.
Reporting harassment does not erase a valid debt, so continue documenting payments and verifying the correct account balance.