Quick answer

An online lender may demand payment through lawful, respectful collection methods. It may not threaten you, publicly shame you, use deceptive collection tactics, or indiscriminately access and message people in your phone or social-media contacts.

Preserve the evidence before blocking numbers or uninstalling the app. Then report:

Unfair debt collection to the Securities and Exchange Commission (SEC), including complaints against unrecorded or apparently unlicensed lending apps.
Misuse or disclosure of personal data to the National Privacy Commission (NPC).
Threats, violence, fraud, extortion, impersonation, or other possible crimes immediately to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.
A bank or other BSP-supervised institution first to that institution’s consumer-assistance channel, then to the Bangko Sentral ng Pilipinas if unresolved.

These remedies may be pursued at the same time when their requirements are met. The NPC’s usual 15-day prior-notice requirement does not prevent an immediate SEC or law-enforcement report.

A complaint does not automatically cancel a valid loan. Continue requesting an accurate statement of account and a lawful payment arrangement while disputing the harassment, unauthorized charges, or misuse of data.

Conduct that may violate the rules

The SEC prohibits unfair collection practices by lending and financing companies and their collectors. Prohibited conduct includes:

Threatening violence, damage to property, reputational harm, or other criminal acts.
Threatening arrest, prosecution, seizure, or another step that cannot legally be taken under the circumstances.
Using obscenities, insults, or abusive language.
Publishing or disclosing a borrower’s name and personal information to shame the borrower.
Communicating loan information known, or reasonably expected, to be false—including failing to say that a debt is disputed when communicating information under an otherwise permitted exception.
Using false representations or deceptive methods to collect or obtain information.
Contacting people in the borrower’s contact list who are not proper guarantors.
Ordinarily contacting a borrower before 6:00 a.m. or after 10:00 p.m.

The SEC rule contains a narrow exception to the time restriction when the account has been past due for more than 15 days or the borrower expressly agreed, in written, electronic, or recorded form, that those hours were the only reasonable times for contact. That exception does not authorize threats, insults, public shaming, deception, or privacy violations. The prohibited practices and time rule are reproduced in an official SEC cease-and-desist order applying Memorandum Circular No. 18, series of 2019.

The Financial Products and Services Consumer Protection Act also requires fair and respectful treatment, prohibits abusive collection or debt-recovery practices, protects client data, and makes a regulated provider responsible for relevant acts of its employees and agents. A provider may also be solidarily liable with an accredited third-party service provider involved in debt collection. See Republic Act No. 11765.

Privacy violations involving lending apps

Under the Data Privacy Act, personal information must be processed transparently, for a legitimate purpose, and proportionately. It must be adequate and relevant—not excessive—and retained only as long as necessary for the disclosed purpose, a legitimate business purpose, a legal claim, or another lawful ground. Data subjects also have rights to information, access, correction, blocking or deletion in proper cases, and indemnity for damage caused by unlawful processing. See the official text of the Data Privacy Act of 2012.

For online loans, the government’s current rules and guidance specifically prohibit:

Unnecessary app permissions.
Unauthorized, excessive, or disproportionate access to contact lists.
Processing contact-list data in a way that leads to harassment.
Using contacts for debt collection outside the guarantors provided by the borrower.
Using a borrower’s photograph to harass or embarrass the borrower.
Keeping personal data longer than legally necessary.
Treating a character reference automatically as a guarantor.

An app may provide a limited interface for selecting a character reference or guarantor, and it may derive proportionate metadata when genuinely necessary for a specified lawful purpose. Unrestricted harvesting or copying of the entire contact list is prohibited. Among third parties, a person may be contacted for debt collection only if that person separately and expressly consented to become a guarantor. Character references are for identity or information verification; they are not automatically responsible for the loan.

Clicking “Allow contacts” does not give a lender unlimited authority to copy, retain, disclose, or use everyone’s information for shaming or collection. The current position is stated in the joint DICT-NPC-SEC Advisory on Online Lending Platforms dated March 18, 2026.

Preserve evidence before taking down or blocking anything

Save evidence promptly because posts, messages, app listings, and accounts can disappear.

Keep:

Full-screen screenshots showing the message, sender’s number or profile, date, and time.
The complete message thread—not only the most offensive line.
Original emails, including headers and attachments.
Call logs and any voicemail left by the collector.
URLs and screenshots of social-media posts, comments, group messages, or edited photos.
The app-store listing, developer name, privacy notice, permissions page, and app version.
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, website, and customer-service details, if displayed.
The loan agreement, disclosure statement, promissory note, statement of account, repayment schedule, receipts, and payment confirmations.
Proof of the amount actually received and every amount already paid.
Messages sent to relatives, co-workers, employers, or other contacts. Ask each recipient to preserve the original message and prepare a short signed account of what happened.
Proof of your written complaint to the lender or its data protection officer, including delivery or read receipts.
A chronological list of incidents stating who contacted whom, the number or account used, what was said or disclosed, and when it happened.

Back up the files to another device or secure storage. Keep unedited originals and make separate redacted copies for ordinary correspondence.

Do not secretly record a private telephone conversation without legal advice and the authorization required by law. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties and may also make an unlawfully obtained recording inadmissible. Save written communications, call logs, and voluntarily left voicemail instead. See Republic Act No. 4200.

Protect your accounts and contacts

After preserving evidence:

Revoke the app’s access to contacts, photos, files, camera, microphone, location, and other permissions that are no longer necessary.
Change passwords for your email, social-media, cloud-storage, and financial accounts if the app or collector may have obtained access.
Enable multi-factor authentication where available.
Warn affected contacts not to reply, send money, open links, disclose information, or forward an OTP.
Report impersonating or abusive accounts to the relevant social-media or app-store platform—but only after saving the post, profile URL, and other evidence.
If you uninstall the app, do so only after copying the agreement, account details, messages, permissions, and other evidence. Uninstalling does not retrieve information the lender already copied.
Pay only through a verified channel belonging to the actual creditor. Do not send money to a collector’s personal account merely because of a threat.

Identify the responsible company

An app’s brand name may differ from the legal name of the lending or financing company. Look for the legal entity in:

The loan agreement or disclosure statement.
The app’s privacy notice and terms.
The app-store developer information.
Payment instructions and receipts.
Collection messages or email signatures.
The corporate name, SEC registration number, and Certificate of Authority number that should appear on the platform or advertising.

Include both the app name and the legal company name in every complaint. If the operator cannot be identified, provide the app-store link, developer name, website, collector numbers, email addresses, social-media profiles, and recipient payment accounts. Do not delay reporting solely because the company concealed its identity.

Report unfair collection to the SEC

Use the SEC’s official iMessage portal. The March 2026 joint advisory directs complaints about unfair collection by lending and financing companies to the SEC Financing and Lending Companies Department.

On iMessage:

Create or sign in to your account and open a new ticket.
Choose the Financing and Lending Companies Department.
Select the service for Complaints on Financing and Lending Companies under its Monitoring and Compliance function.
State the app name, legal company name if known, loan details, dates of harassment, collector numbers or accounts, and the exact prohibited conduct.
Attach organized and readable evidence.
State what you want the SEC to investigate, such as unfair collection, operation without authority, undisclosed company information, or an unrecorded online lending platform.
Save the ticket number and monitor the portal for requests or updates.

The official iMessage user guide explains ticket creation and identifies the proper department. The SEC may investigate and impose appropriate administrative sanctions; possible consequences include fines and suspension or revocation of authority, but filing a complaint does not guarantee a particular result.

Report the privacy violation to the NPC

1. Send the lender a written privacy complaint

Ordinarily, before the NPC gives a formal complaint due course, you must notify the lender, its data protection officer, or other responsible entity in writing and allow it to act.

Identify the incidents and request appropriate relief, such as:

Stop contacting non-guarantors and stop further unauthorized disclosure.
Identify what personal data was collected, its source, how it was used, and the recipients to whom it was disclosed.
Correct false personal or loan information.
Block, remove, or securely delete data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary.
Preserve relevant access, disclosure, collection, and communication logs for the investigation.
Confirm the action taken in writing.

Do not demand deletion of every loan record without qualification. A lender may retain information still necessary to perform the contract, establish or defend a legal claim, comply with law, or pursue another lawful purpose.

2. Observe the 15-day rule

The NPC’s 2021 Rules of Procedure generally require proof that:

You informed the respondent in writing; and
The respondent failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice.

If it is safe, allow the full 15 days before filing when the company has not responded. Preserve proof of the date of receipt.

The NPC may waive this requirement for proven good cause or a serious Data Privacy Act violation, considering the risk of harm—for example, grave and irreparable damage that only NPC action can prevent or mitigate, lack of a plain, speedy, or adequate remedy from the respondent, or patently illegal conduct. Explain and document the emergency instead of merely stating that the collector was hostile. See the 2021 NPC Rules of Procedure, as amended.

3. Complete the current complaint form

Use the Complaint-Affidavit effective July 1, 2025, not an older form.

Complete it accurately, have it notarized, and attach:

A valid government-issued ID.
Your written notice to the respondent and proof of receipt.
The response, if any.
Documentary evidence and relevant witness affidavits.
The identity and available address or contact details of the respondent.
A clear factual chronology.
The relief requested.
The required verification and certification against forum shopping.
A special power of attorney if an authorized representative is filing for an adult data subject.

Failure to attach evidence or satisfy the required form and contents can result in outright dismissal. If you later learn that a similar case involving the same issues has been filed elsewhere, the certification requires disclosure to the NPC within five calendar days.

4. File and pay the assessed fee

A notarized complaint may be filed in person, by courier, or as a scanned PDF by email to complaints@privacy.gov.ph. The NPC’s current address is:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City 1103

Check the official NPC complaint-filing page and complaint mechanics before submission.

The schedule presently linked by the NPC lists a ₱500 complaint filing fee, a legal research fee, and additional fees when damages or particular motions are sought. The NPC assesses the amount through its Service Request and Assessment Form process; wait for the assessment before paying through the designated government payment channel.

Indigent litigants may seek exemption if both statutory conditions in the current schedule are met: the gross income of the litigant and immediate family does not exceed twice the applicable monthly minimum wage, and they do not own real property with a fair market value exceeding ₱300,000. Supporting certificates and affidavits are required. Review the NPC Schedule of Fees and Charges and the online-payment advisory.

If harmful processing or disclosure is continuing, ask about an application for a temporary ban on processing. It requires a proper motion and may involve a fee and bond; the NPC provides a separate temporary-ban filing page.

If the lender is supervised by the BSP

The BSP route applies only when the complained-of product or service is provided by a BSP-supervised institution, such as a bank or another covered financial institution. Some apps originate loans for, or operate with, a supervised institution, so check the loan agreement and disclosure statement.

First report the matter to the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel. This first-level complaint is a condition for escalation to the BSP.

If the response is absent or unsatisfactory:

Use the BSP Online Buddy chatbot on the BSP website or official Facebook page until a BSP complaint reference number is generated; or
Complete the BSP Complaint/Inquiry/Reply form and email it to consumeraffairs@bsp.gov.ph, attaching proof that you first complained to the institution.

Follow the current BSP Consumer Assistance guidance. Do not include your PIN, password, OTP, full account or card number, passbook, passport, or unnecessary identification documents.

Report threats, fraud, or other possible crimes immediately

Do not wait 15 days when there is a threat of physical harm, stalking, extortion, identity theft, fraudulent payment instructions, account takeover, or another urgent safety risk.

For immediate danger, call 911 or go to the nearest police station. For cyber-enabled conduct, the March 2026 joint advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: (02) 8723-0401 local 7491

The PNP ACG also publishes national and regional reporting contacts in its official contact directory.

An email may begin the referral, but investigators may require personal appearance, identification, a sworn statement, original files, or access to the device. Ask for a complaint or reference number and follow the investigating office’s instructions. Whether particular conduct constitutes grave threats, coercion, cyberlibel, fraud, a data-privacy offense, or another crime depends on the words used, surrounding facts, identity of the actor, and available evidence.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Submitting cropped screenshots that omit the sender, date, or surrounding conversation.
Naming only the app and not the company operating it.
Filing an NPC complaint without first sending written notice or explaining and proving why the requirement should be waived.
Failing to attach proof that the lender received the notice.
Using an old, unnotarized NPC form.
Secretly recording calls without considering the Anti-Wiretapping Act.
Posting unredacted loan documents or identification online while asking for help.
Paying a collector’s personal account without confirming that it belongs to the creditor.
Sharing an OTP, PIN, password, or complete card credentials with a collector or supposed government officer.
Assuming a privacy or harassment complaint automatically erases the debt.
Ignoring genuine court papers. A collection message is not itself a summons, but an authentic summons or subpoena requires prompt legal attention.

When legal help is urgent

Consult a lawyer promptly when:

A collector threatens violence, visits your home or workplace aggressively, or publishes your address and location.
The harassment involves children, intimate images, sexual threats, identity documents, or access to financial accounts.
The lender is contacting an employer or large numbers of people and the disclosure is continuing.
You need an NPC temporary ban, injunction, damages, or another urgent remedy.
You received genuine court, prosecutor, police, SEC, BSP, or NPC papers.
The amount, interest, fees, or identity of the creditor is seriously disputed.
You have filed or plan to file related cases in more than one forum, because the NPC requires accurate disclosure against forum shopping.

Claims under Republic Act No. 11765 generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, subject to an absolute ten-year limit from the violation. Other civil, criminal, privacy, and administrative claims may have different periods. Preserve evidence and obtain advice early rather than relying on the longest possible period.

For a purely civil financial claim seeking only payment or reimbursement, the BSP or SEC may adjudicate claims not exceeding ₱10 million under Republic Act No. 11765. Whether that procedure covers the relief you want is fact-dependent.

Frequently asked questions

Can a lending app contact my family, friends, or employer?

It may not blast your contact list or disclose the debt to shame you. Under the current joint government advisory, a third party may be contacted for collection only when that person separately consented to be a guarantor. A saved contact or character reference is not automatically a guarantor.

What if I gave the app permission to access my contacts?

Permission is not unlimited consent. Unnecessary, excessive, or disproportionate processing remains prohibited, and borrower consent does not authorize debt-collection messages to non-guarantors.

Can a character reference be required to pay?

Not merely because the person was named as a character reference. A guarantor must separately and expressly consent to assume responsibility for the loan in accordance with applicable law.

Can I complain even if I really owe money?

Yes. A genuine debt does not legalize threats, insults, public shaming, deception, or unlawful use of personal data. The complaint and the obligation should be handled as separate issues.

Can a non-borrower file a complaint?

Yes, when that person’s own personal data was processed or disclosed unlawfully. The affected person can also report harassment or threats to the appropriate authorities.

Should I block the collector?

Preserve the complete evidence first. You may then block abusive numbers and restrict app permissions. Keep at least one safe written channel available if you still need the creditor’s statement of account or formal response.

What if the app or company appears unlicensed?

Report it to the SEC through iMessage. Include every identifier available: app link, developer, website, telephone numbers, email addresses, payment accounts, advertisements, and copies of the loan documents.

Will the SEC, NPC, or police award damages automatically?

No. Each office has a different mandate and procedure, and liability must be established from the evidence. Administrative sanctions, criminal prosecution, damages, reimbursement, and deletion or blocking of data are distinct remedies.

Official sources

This article provides general legal information, not advice for a specific case. The correct remedy may depend on the loan documents, identity and regulator of the provider, communications used, and relief sought. Laws, forms, fees, addresses, and reporting channels were checked against official and primary sources on August 4, 2026.