Quick answer

Online lending app harassment can be reported through more than one channel:

Preserve the evidence before blocking, uninstalling, or changing permissions.
Send a written complaint to the lender’s consumer-assistance unit and Data Protection Officer (DPO).
Report unfair collection by a lending or financing company to the SEC Financing and Lending Companies Department through SEC iMessage.
For misuse or disclosure of personal data, file a formal complaint with the National Privacy Commission (NPC). Ordinarily, you must first notify the company in writing and allow it to act. If it does not take timely and appropriate action—or does not respond within 15 calendar days from receipt—you may proceed with the NPC complaint. The NPC may waive this requirement for good cause or a serious privacy violation.
Do not wait for the lender’s response when there is an immediate threat, extortion, fraud, impersonation, or danger. Report it promptly to the police, PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.

Reporting misconduct does not automatically cancel a valid loan. Keep addressing any legitimate balance through the lender’s verified payment and dispute channels while separately pursuing the complaint.

What collectors are—and are not—allowed to do

A lender may demand payment of a legitimate, due debt, send accurate account notices, offer restructuring, and pursue lawful remedies. It must do so fairly, respectfully, and within privacy limits.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, prohibits abusive collection or debt-recovery practices. It also makes a regulated financial service provider responsible for its employees and agents and solidarily liable with accredited third-party service providers for relevant acts or omissions.

Under SEC Memorandum Circular No. 18, series of 2019, prohibited practices include:

Using or threatening violence or other criminal means to harm a person, reputation, or property
Threatening action that cannot legally be taken
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense
Publishing borrowers’ names or personal information outside lawful exceptions
Communicating false loan information, including failing to disclose that a debt is disputed when required
Using false representations or deceptive means to collect a debt or obtain information
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower has expressly agreed—through written, electronic, or recorded means—that those are the only reasonable contact times
Contacting people in the borrower’s contact list who are not proper guarantors

The timing exception does not authorize threats, insults, public shaming, false statements, or privacy violations.

Contact lists, character references, and guarantors

The rule is more precise than saying an app can never access contacts. Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

An app may have limited contact-list access when necessary to let the borrower select a character reference or guarantor, or to derive proportionate metadata for a specified, legitimate purpose.
Unrestrained, excessive, or disproportionate processing of the contact list is prohibited.
A character reference may be contacted only to verify the borrower’s identity and the truth of information supplied in the application. The reference must be told how the details were obtained and must be offered the option to have the information removed.
A character reference is not automatically a guarantor.
A guarantor must separately and expressly consent to assume responsibility for the debt.
For debt collection, the lender may contact the guarantor—not unrelated relatives, friends, co-workers, employers, or other phone contacts.

The government’s 18 March 2026 joint advisory on online lending platforms applies these protections to lending companies, financing companies, and other persons offering or facilitating loans through online platforms, whether recorded or unrecorded.

Photos, camera access, and other app permissions

Camera or gallery access may be permitted for a specified and legitimate purpose such as identity verification, know-your-customer procedures, fraud prevention, or payment verification. It should be disabled, revocable, or no longer accessed after that purpose is fulfilled.

A borrower’s photo must not be edited, posted, or circulated to shame the borrower into paying. Apps also must not demand unnecessary permissions or use information for an undisclosed, excessive, or incompatible purpose.

Tapping “Allow” does not give the company unlimited authority. Consent under the Data Privacy Act of 2012 must be freely given, specific, and informed. Consent obtained through deceptive design—such as pre-ticked boxes or an interface that makes consent easy but withdrawal difficult—may be invalid.

Preserve evidence before taking action

Save evidence first because messages, accounts, app listings, and social-media posts may disappear.

Keep:

Screenshots of every message, post, comment, email, and in-app notice, showing the date, time, sender, phone number, username, and URL when available
The original SMS, chat, email, voicemail, and social-media content
Call logs showing the numbers, frequency, date, time, and duration of calls
Screenshots from contacts who were messaged, preferably with their written account or affidavit
Screenshots of the app’s permissions, privacy notice, consent screens, developer name, download page, and version
The app name and the lender’s exact corporate name, SEC registration number, Certificate of Authority number, office address, and advertised contact information
The loan agreement, disclosure statement, statement of account, repayment schedule, receipts, and proof of payments
Copies of identification or images that the collector altered or disclosed
Your written complaint to the company, proof that it was received, and every response
Proof of harm, such as employer correspondence or records showing that the material was circulated

Prepare a chronological incident log. Keep an untouched copy of every file and make backups. Crop or annotate only duplicate copies, not the originals.

Do not secretly record private calls merely to obtain evidence. Republic Act No. 4200 generally requires authorization from all parties to record a private communication, and the Supreme Court has held that the prohibition can apply even when the recorder is a participant. Preserve call logs, voicemails, and written messages instead, or obtain consent before recording. See Republic Act No. 4200 and Ramirez v. Court of Appeals.

Send the company a written complaint

Address the complaint to both the lender’s consumer-assistance unit and DPO. Use the official email or channel shown in the contract, privacy notice, app, or company website—not an address supplied only by an aggressive collector.

State:

Your name and loan or account reference, with sensitive details partly masked where possible
The app and corporate names
The collector’s name, number, account, or username
Each incident’s date, time, platform, and exact conduct
Which personal data was accessed, used, or disclosed
Who received the information and how you learned of the disclosure
Whether the balance or any charge is disputed
The specific resolution requested

Depending on the facts, request that the company:

Stop threats, shaming, abusive language, and contact with non-guarantors
Stop unauthorized disclosure or processing
Preserve relevant records, call logs, collection instructions, and agent information
Identify the source of your data and the persons or entities that received it
Correct inaccurate information
Block, remove, or destroy unlawfully obtained, unauthorized, or no-longer-necessary data
Confirm the authority and identity of any third-party collector
Provide an accurate statement of account and a written response

Erasure is not absolute. A lender may retain information that remains necessary to perform a contract, comply with law, report authorized credit information, or establish, exercise, or defend legal claims. It may not keep personal data indefinitely for an undefined possible future use.

Report unfair collection to the SEC

For an SEC-supervised lending or financing company, file through SEC iMessage and direct the complaint to the Financing and Lending Companies Department or FINLEND. The March 2026 joint advisory also lists 1-4732 (1-4SEC) as the SEC hotline for unfair debt-collection complaints.

Attach:

Your incident chronology
Screenshots and messages
The loan agreement and statement of account
The app and corporate names
Available SEC registration and Certificate of Authority details
The collector’s identifying information
Your written complaint to the company and its response
The relief you are requesting

Check the operator through Check with SEC. Corporate registration alone is not necessarily authority to operate as a lending or financing company; look for the appropriate Certificate of Authority. A missing corporate name, SEC registration number, or Certificate of Authority number in the app or advertisement is also worth documenting.

Report an apparently unlicensed or unidentified operator to the SEC. Do not assume, however, that the absence of a license automatically settles every contractual question or erases money actually received. Have the documents reviewed if the lender’s identity or right to collect is disputed.

File a privacy complaint with the NPC

Use this route when the app or collector accessed, copied, retained, altered, or disclosed personal data unlawfully—for example, by harvesting contacts, sending loan details to co-workers, posting a borrower’s photo, refusing to remove a character reference, or using data for an undisclosed purpose.

Observe the 15-day pre-complaint rule

Under the 2021 NPC Rules of Procedure, as amended, a complaint ordinarily will not be given due course unless you establish that:

You informed the personal information controller, processor, or concerned entity in writing about the violation; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving your written notice.

The NPC may waive this requirement for proven good cause or a serious violation, including circumstances involving grave and irreparable damage, lack of a plain and adequate remedy from the respondent, or conduct that is patently illegal. Explain and document the urgency if asking for a waiver.

Prepare the formal complaint correctly

Use the NPC’s current Complaint-Affidavit/Reklamong Salaysay dated 1 March 2026. The complaint must be written, signed, verified, and accompanied by supporting evidence. The form includes a verification, certification against forum shopping, and jurat for notarization.

Include:

Complete complainant and respondent information
A clear chronological statement of facts
The specific personal data processed or disclosed
Evidence of the conduct and resulting harm
Your written notice to the company and proof of receipt
Witness affidavits, when available
At least one requested form of relief
A valid government-issued ID
Full disclosure of any related case or complaint already filed elsewhere

Failure to attach evidence or comply with the required form can result in dismissal without prejudice. If another case involving the same issues exists, disclose its status rather than omitting it.

The NPC accepts complaints personally, by registered mail, by courier, or by electronic mail when authorized by the Commission. Follow the current submission and PDF-signing instructions on the NPC complaint-filing page; the listed complaints address is complaints@privacy.gov.ph. The 2026 form identifies the NPC office at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103.

The current NPC schedule of fees provides a ₱500 complaint filing fee, plus a legal research fee of 1% of the filing fee but not less than ₱10. Claims for damages can carry additional fees. Qualified indigent complainants may seek an exemption by submitting the required proof, including income, property, and barangay-indigency documents. Obtain the NPC’s assessment and payment instructions; do not pay through a private account.

The investigating officer has 30 calendar days from receipt to give the complaint due course or dismiss it without prejudice. That is an initial evaluation period, not a guaranteed date for final resolution.

Report threats, fraud, or other possible crimes

For imminent threats, stalking, extortion, impersonation of police or courts, fraudulent payment demands, or fear for physical safety, go to the nearest police station or appropriate cybercrime office immediately. Bring the device and copies of the evidence, but keep your own backup.

The March 2026 government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (632) 8723-0401 local 7491

Describe the acts and supply the original evidence. Let investigators and prosecutors determine the applicable offense; not every rude collection message automatically establishes a criminal case, while a credible threat may require immediate intervention.

If the provider is regulated by the BSP

Some loan products are offered by banks, digital banks, electronic-money issuers, pawnshops, or other Bangko Sentral-supervised institutions rather than SEC-supervised lending companies.

First file with the institution’s Financial Consumer Protection Assistance Mechanism. If the institution does not act within a reasonable period or its response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism. Complaints may be submitted through the BSP Online Buddy on the BSP website. If BOB is unavailable, the current alternative is a completed CIR form sent to consumeraffairs@bsp.gov.ph, with proof of the complaint previously lodged with the institution.

A complaint to the NPC may still be appropriate when the same incident involves unlawful personal-data processing.

Protect yourself while the complaint is pending

After preserving evidence, revoke unnecessary permissions for contacts, camera, photos, location, microphone, and storage.
Uninstall the app if it is no longer needed, but remember that uninstalling does not delete data already copied to the lender’s systems.
Change reused passwords and secure affected email, banking, and e-wallet accounts.
Tell contacted relatives, friends, and co-workers not to pay, disclose information, click links, or argue with collectors. Ask them to preserve the messages.
Pay only through a verified company channel and demand an official receipt. Do not transfer money to a collector’s personal account without independently confirming that the company authorized it.
If the balance is disputed, state the dispute in writing and request an itemized statement.
If the debt is valid but unaffordable, request restructuring or a written payment arrangement. Do not promise an amount or date you cannot meet.
Do not ignore an authentic summons, subpoena, court order, or regulator communication. Verify it directly with the issuing office.

No person may be imprisoned solely for debt, under Article III, Section 20 of the 1987 Constitution. That does not prevent proceedings based on a separately alleged offense or excuse ignoring genuine legal process.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence
Posting unredacted IDs, contracts, phone numbers, or private conversations publicly
Treating a character reference as automatically liable for the loan
Assuming consent to app permissions authorizes unlimited contact harvesting or public shaming
Sending only a general statement such as “They harassed me” without dates, exact messages, sender details, and attachments
Filing an NPC complaint without first sending the required written notice—or without explaining why the requirement should be waived
Omitting a related SEC, NPC, police, prosecutor, or court case from the certification against forum shopping
Secretly recording a private call without the other parties’ authorization
Paying an unknown personal account because of a threat or fake deadline
Believing that reporting misconduct automatically extinguishes the loan

When legal help is urgent

Seek a lawyer promptly when:

A threat appears credible or identifies your home, workplace, children, or daily routine
Intimate images, government IDs, financial credentials, or sensitive personal information were disclosed
The collector impersonates a judge, sheriff, prosecutor, police officer, or government agency
You receive an authentic summons, subpoena, warrant, or formal demand involving substantial claims
Your salary, property, employment, or financial accounts are threatened through an asserted legal process
Multiple regulators or cases involve the same facts and the forum-shopping certification may be affected
You are seeking damages, a temporary ban on data processing, or other urgent relief

Those who qualify may approach the Public Attorney’s Office. The Integrated Bar of the Philippines National Center for Legal Aid is another possible source of legal assistance.

Frequently asked questions

Can a lender tell my family or employer that I owe money?

Generally, it may not contact unrelated people to collect the debt or shame you. A character reference may be contacted for identity and information verification, not debt collection. A separately consenting guarantor may be contacted regarding the obligation. Lawful court service, regulatory reporting, and authorized credit reporting are different from public shaming.

Can I complain even if the debt is real or overdue?

Yes. A valid debt does not authorize threats, insults, false representations, disproportionate data use, or disclosure to non-guarantors. The debt and the collector’s conduct are separate issues.

Can a contact who never borrowed money file a privacy complaint?

Potentially, yes. A person whose own name, number, messages, or other personal information was processed or disclosed may be a data subject affected by the violation. That person should preserve the messages, notify the company in writing, and follow the NPC procedure.

Can I demand deletion of all my data immediately?

You may request blocking, removal, or destruction when data is unlawfully obtained, used for an unauthorized purpose, inaccurate, outdated, or no longer necessary. The lender may lawfully retain limited records needed for the contract, regulatory duties, credit reporting, or legal claims. The correct result depends on the data and purpose involved.

What if the app has disappeared from the app store?

You may still report it. Preserve the former listing, developer name, download records, installation details, messages, payment accounts, and corporate information. Report an unidentified or unlicensed operator to the SEC and possible threats or fraud to the appropriate cybercrime authority.

Will the SEC or NPC erase the debt?

Not merely because a complaint was filed. These agencies may investigate regulatory or privacy violations and impose appropriate remedies or sanctions. Whether the debt is valid, correctly computed, paid, void, or otherwise unenforceable depends on the agreement, disclosures, payments, applicable law, and evidence.

This article provides general Philippine legal information, not advice for a specific case and not an assurance of any agency or court outcome. Procedures and conclusions can depend on the lender’s regulator, the loan documents, the data processed, and the exact communications. Official sources and reporting channels were checked as of 30 July 2026.