Quick answer

You can report an online lending app for harassment, unfair collection practices, or misuse of personal data even if you genuinely owe money. A valid debt does not authorize threats, insults, public shaming, deceptive messages, unauthorized access to your contacts or photos, or disclosure of your loan to unrelated people.

Use the complaint route that matches the conduct:

Report unfair debt collection by a lending or financing company to the Securities and Exchange Commission (SEC) through iMessage.
Report unlawful collection, disclosure, or use of personal data to the National Privacy Commission (NPC). Ordinarily, you must first complain to the lender in writing and give it 15 calendar days from receipt to take timely and appropriate action.
Report threats, extortion, impersonation, hacking, fraud, or immediate danger to law enforcement without waiting for the lender’s response.
If the provider is supervised by another financial regulator, such as the Bangko Sentral ng Pilipinas (BSP), the Insurance Commission, or the Cooperative Development Authority, use that regulator’s complaint mechanism as well.

Preserve the evidence before blocking numbers, revoking permissions, uninstalling the app, deleting messages, or changing your account.

What conduct can be reported?

Debt collectors may communicate for legitimate collection purposes, identify the obligation accurately, and pursue lawful remedies. They may not use collection as a license to intimidate or humiliate you.

Possible unfair or abusive collection practices include:

Threatening violence, arrest, imprisonment, deportation, harm to property, or another action the collector cannot legally take
Using obscenities, insults, discriminatory language, repeated verbal abuse, or degrading statements
Pretending to be a police officer, lawyer, court employee, government agency, or another person
Sending fabricated warrants, court orders, demand letters, case numbers, or “barangay blotter” notices
Falsely claiming that a criminal case has already been filed or that arrest is automatic for nonpayment
Posting your name, photograph, identification document, loan information, or alleged delinquency online
Creating group chats or messaging your employer, coworkers, relatives, friends, or other contacts to shame or pressure you
Contacting people in your phonebook who are not valid guarantors
Using your photograph, contact list, social-media contacts, files, or other device data to embarrass you
Continuing abusive messages after you have asked for communications to be made through a reasonable, documented channel

The SEC’s rules prohibit unfair debt collection by financing and lending companies and make the company responsible for the conduct of its collection agencies and other representatives. See SEC Memorandum Circular No. 18, series of 2019.

Whether a particular call or message is unlawful depends on its words, timing, frequency, recipient, purpose, and surrounding circumstances. Save the complete exchange rather than only the most offensive line.

Your privacy rights when using a lending app

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to be transparent, proportionate, relevant, and limited to a legitimate purpose. Giving an app one permission does not necessarily authorize every later use of the information it can access.

Under NPC Circular No. 20-01, as amended, entities processing data for loan transactions must not:

Require unnecessary or excessive app permissions
Harvest or save phone or email contacts for debt collection or harassment
Harvest social-media contacts for those purposes
Use a borrower’s photograph to harass or embarrass the borrower
Keep personal data indefinitely for an undefined future use
Process personal data in a manner inconsistent with the stated, lawful purpose

An app may request access to a camera or photo gallery when genuinely necessary for identity verification or fraud prevention. That does not authorize the lender to turn the photograph into a shaming poster or send it to other people.

Contact-list access is also tightly limited. Current joint government guidance says an online lending platform may use it only to let the borrower select character references or guarantors, or to derive proportionate metadata when necessary for a specified and legitimate purpose. Unrestricted processing is prohibited. For debt collection, the lender may contact a person identified as a guarantor who separately consented to that role—not everyone saved in the borrower’s phone. A character reference is not automatically a guarantor.

These rules apply to entities acting as lenders or financing companies even when they lack the required SEC authority. Lack of registration does not place an operator beyond the Data Privacy Act.

Do this before deleting the app

Preserve evidence in its original context. If safe, collect:

App identity
- Exact app name and icon
- Developer or publisher shown in the app store
- Download-page URL
- Website, email addresses, phone numbers, and social-media accounts
- Name of the lending or financing company in the loan agreement, privacy notice, disclosure statement, or payment instructions
Loan records
- Application, disclosure statement, promissory note, loan agreement, and repayment schedule
- Amount requested, amount actually received, due date, charges, payments, and remaining balance
- Receipts, transaction reference numbers, and bank or e-wallet records
- Collection agency’s name and claimed authority to collect
Harassment evidence
- Full screenshots showing the sender, date, time, number, account name, and surrounding conversation
- Call logs, voicemails, emails, group-chat membership, posts, comments, and profile links
- Copies of false legal documents or threatening graphics
- A chronological log stating what happened, when, through which channel, and who witnessed it
Privacy evidence
- Screenshots or screen recordings of requested app permissions
- The privacy notice and consent screen that applied when you installed or used the app
- Notices showing changes to permissions or data use
- Messages sent to contacts, with their permission
- Written statements or affidavits from contacts who received collection messages

Export chats or emails where possible. Keep unedited originals and make backup copies. Do not publicly repost identification documents, account details, intimate images, or other sensitive evidence merely to expose the lender.

After documenting the permissions, use your phone settings to revoke access that is no longer necessary, particularly access to contacts, photos, files, microphone, camera, or location. Change reused passwords, enable multifactor authentication, review active sessions, and alert your bank or e-wallet provider if account credentials or financial information may have been exposed.

Step 1: Send the lender a written complaint and preservation request

Send your complaint to the lender’s customer-service channel and, if available, its data protection officer. Use an address stated in the loan agreement, privacy notice, app, or official company website.

Include:

Your full name and enough account information to identify the loan
The app and company involved
A factual timeline
The telephone numbers, accounts, or collection agents involved
The personal data collected, disclosed, or misused
The names or categories of third parties contacted
Copies of key evidence
The action you want taken

You may ask the lender to:

Stop threats, public shaming, and contact with unrelated third parties
Restrict collection communications to a stated lawful channel
Identify the company and collection agency responsible
Explain where it obtained particular personal data and to whom it disclosed the data
Correct inaccurate account or personal information
Delete or block data that has no lawful retention basis, subject to records the company must lawfully keep
Preserve call recordings, collection notes, access logs, disclosure records, account records, and communications relevant to the incident
Confirm its action in writing

Keep proof of sending and receipt. For an NPC complaint, this step is particularly important: the current rules ordinarily require proof that you informed the entity in writing and that it failed to take timely and appropriate action, or did not respond within 15 calendar days after receipt.

The NPC may waive this exhaustion requirement for good cause or a serious violation—for example, where urgent NPC action is necessary to prevent grave and irreparable harm, no adequate remedy is available from the respondent, or the conduct is patently illegal. Explain and prove the circumstances if you ask for a waiver.

Step 2: Report unfair collection to the SEC

The SEC regulates lending and financing companies and their online lending platforms. File through the SEC’s official iMessage complaint portal and select the service or department for financing and lending companies when prompted.

A useful SEC submission should identify:

The app, corporate lender, and collection agency, if known
The collector’s numbers, usernames, and email addresses
Your loan or account reference
The dates and exact conduct complained of
Whether relatives, coworkers, employers, or other contacts were approached
Whether the operator appears to be unregistered or unauthorized
The resolution you requested from the company and its response
Your screenshots, recordings, documents, receipts, and witness statements

Do not assume the app’s brand name is the legal company name. Check the agreement, privacy notice, disclosure statement, and payment recipient. Give the SEC every identifying detail available if the operator concealed its identity.

The government’s March 2026 advisory lists the SEC Financing and Lending Companies Department complaint portal at imessage.sec.gov.ph and the SEC hotline 1-4732 (1-4SEC). See the DICT-NPC-SEC Public Advisory on Online Lending Platforms.

Step 3: File a privacy complaint with the NPC

A borrower whose personal data was misused may complain to the NPC. A person in the borrower’s contacts may also file regarding the processing or disclosure of that person’s own data.

Use the NPC’s current formal complaint instructions and form. A formal complaint generally must be:

In writing and signed
Verified under oath, ordinarily through a notarized complaint-assisted form or verified complaint
Accompanied by the evidence and any witness affidavits
Accompanied by a certification against forum shopping
Filed with the required copies and applicable filing fee, unless an exemption or waiver applies

The complaint should identify the complainant and respondent, provide available contact and service details, narrate the material facts, state the privacy violation, attach correspondence with the respondent, and specify the relief requested. If the respondent’s legal identity is unknown, describe the facts that could lead to its identification.

The NPC accepts filings personally, by registered mail, by courier, or by electronic mail when authorized. Its current filing page instructs complainants to submit a scanned complaint by email to complaints@privacy.gov.ph. Check the page immediately before filing because forms, addresses, technical requirements, and fees can change.

Electronic documents must comply with the NPC’s current rules, including digital-signature and PDF requirements where applicable. A representative generally needs a special power of attorney. Different proof applies when a parent or court-appointed guardian represents a minor or person alleged to be incompetent.

The governing procedure is in the 2021 NPC Rules of Procedure, as amended through NPC Circular No. 2024-01.

If you have filed another action involving the same issues, disclose it accurately in the certification against forum shopping. Do not conceal parallel cases or complaints.

Step 4: Contact law enforcement when the conduct may be criminal

Do not wait 15 days if there is an immediate safety risk or an apparent crime. Contact emergency services or the nearest police station when there is a credible threat of violence, stalking, coercion, extortion, unauthorized account access, identity theft, or another urgent danger.

The March 2026 joint advisory lists these channels for harassment, threats, fraud, and scams:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; telephone (632) 8723-0401 local 7491

A law-enforcement complaint is not a guarantee that a criminal charge will be filed. The applicable offense depends on the exact words, conduct, evidence, identity of the actor, and technical findings. Bring the original device and unaltered files if investigators request them.

What reporting does—and does not—do

Reporting harassment does not automatically cancel a valid loan. Continue to distinguish these issues:

Debt validity: whether money is legally owed
Amount and charges: whether the balance, interest, fees, and payments are correctly stated
Collection conduct: whether the methods used are lawful
Data processing: whether the collection, use, disclosure, retention, or security of personal data is lawful

You may dispute the amount, request an accounting, or negotiate payment without admitting allegations you genuinely contest. Pay only through a verified official channel and demand a receipt. Never send money to a personal account merely because a threatening caller gives you a deadline.

An SEC or NPC complaint may lead to investigation and administrative action, but remedies and outcomes depend on the evidence and jurisdiction. The NPC may also refer indications of a criminal Data Privacy Act violation to the Department of Justice. Courts—not collectors—determine civil liability when a dispute is litigated.

Common mistakes to avoid

Deleting evidence too early. Capture messages, permissions, posts, and account details before blocking or uninstalling.
Reporting only the app’s nickname. Identify the corporate lender, developer, collection agency, and payment recipient whenever possible.
Sending cropped screenshots without context. Preserve the sender, number, date, time, URL, and surrounding exchange.
Relying only on phone calls. Put your objection and requested remedy in writing.
Waiting through credible threats. Contact law enforcement immediately when safety or account security is at risk.
Posting your evidence publicly. This can expose more personal data and complicate the dispute.
Claiming every collection contact is illegal. Focus on the specific threat, deception, disclosure, excessive processing, or prohibited recipient.
Ignoring official notices. Harassing messages may be unlawful, but genuine court papers or regulatory communications still require prompt attention.
Assuming references are guarantors. A person becomes a guarantor only through the required agreement and consent; being named as a reference does not by itself create liability.
Making payments without verification. Confirm the creditor, account, amount, and official payment channel first.

When legal help is urgent

Seek help promptly from a Philippine lawyer, the Public Attorney’s Office if you qualify, or an appropriate legal-aid organization when:

A collector threatens physical harm or has disclosed your address or location
Intimate images, identification documents, or sensitive financial information were shared
Your account, SIM, email, bank account, or e-wallet may have been compromised
You receive genuine court papers, a subpoena, or an official investigation notice
The lender claims a large or unexplained balance
Several companies are using the same personal data against you
You need an urgent NPC temporary ban on data processing
You are considering damages, an injunction, or a criminal complaint
A proposed settlement asks you to waive broad rights or sign an admission you do not understand

Frequently asked questions

Can I complain if I missed the payment deadline?

Yes. Default may allow lawful collection and legal remedies, but it does not authorize threats, deception, public shaming, or unlawful processing of personal data.

Can the app message everyone in my contacts?

No. Unrestricted harvesting and use of contacts for collection or harassment is prohibited. Current government guidance states that, for debt collection, the lender may contact a guarantor who separately consented—not unrelated phone contacts. A character reference is not automatically liable for the loan.

Does tapping “Allow contacts” make everything lawful?

No. Consent must satisfy legal requirements, and processing must remain lawful, transparent, necessary, and proportionate. A broad device permission does not give the lender unlimited authority to copy, retain, disclose, or weaponize contact information.

Should I block the collector?

You may block abusive accounts after preserving the evidence. First send a written instruction identifying a reasonable channel for legitimate account communications, when practicable. Blocking a number does not resolve the underlying loan.

Must I wait 15 days before contacting the NPC?

Ordinarily, you must first notify the responsible entity in writing and show that it failed to take timely and appropriate action or did not respond within 15 calendar days after receipt. The NPC may waive this requirement for good cause or a sufficiently serious violation. Law-enforcement and SEC reports need not be delayed merely because the NPC waiting period is running.

Can a contact who was harassed file a complaint?

Yes, if that person’s own personal data was improperly obtained, used, or disclosed. The borrower and affected contacts should preserve their respective messages and may each seek advice on filing based on their own rights and injuries.

Will filing a complaint erase the debt?

No. A complaint addresses regulatory, privacy, or potentially criminal misconduct. It does not automatically extinguish a valid obligation or decide the correct balance.

Can a borrower be arrested simply for failing to pay an ordinary online loan?

Failure to pay an ordinary civil debt does not by itself authorize a collector to arrest you. Criminal liability requires facts constituting an offense and lawful proceedings. Treat fabricated arrest threats as evidence, but obtain legal advice if you receive authentic papers from a court or law-enforcement agency.

Official sources

This article provides general legal information, not advice for a specific case. Facts, documents, regulatory jurisdiction, and later issuances may change the proper remedy. Official sources and filing channels were checked as of 7 August 2026.