Quick answer

You can report an online lending app for harassment to the Securities and Exchange Commission (SEC) and for misuse or disclosure of personal data to the National Privacy Commission (NPC). If messages contain credible threats, extortion, impersonation, account intrusion, or other possible crimes, report them promptly to the Philippine National Police, National Bureau of Investigation, or DOJ Office of Cybercrime.

A legitimate debt does not authorize a lender or collection agent to threaten violence, publicly shame you, send degrading messages, disclose your debt to uninvolved relatives or co-workers, or use your contacts and photos to pressure you. Reporting abusive conduct does not, however, automatically erase a valid loan. Dispute the harassment and the debt separately.

What conduct may be reported?

Unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits lending and financing companies—and collection agencies, lawyers, employees, agents, and other persons acting for them—from using unfair collection practices.

Depending on the evidence and circumstances, report conduct such as:

Threats of violence, physical harm, property damage, arrest, or another action that cannot legally be taken
Obscene, insulting, humiliating, or profane messages
Repeated communications intended to annoy, abuse, or oppress
False claims that the sender is a police officer, court employee, lawyer, government representative, or another person they are not
False documents or messages made to look like court processes, warrants, or official government notices
Publicly posting or circulating a borrower’s name, photograph, loan balance, or alleged default to shame the borrower
Disclosing the debt to people who are not legally involved in the obligation
Contacting people in the borrower’s phonebook merely to embarrass or pressure the borrower
Using threats against the borrower’s reputation, family, employment, or property as leverage for payment

A real collection notice, demand letter, summons, or court pleading should not be ignored. Verify it independently through the court, agency, or law office identified in the document—not through a telephone number supplied only in a suspicious message.

Privacy violations

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, online lenders must not engage in unnecessary, excessive, or disproportionate processing. Potential violations include:

Harvesting or using an entire phone, email, or social-media contact list without a proper and proportionate purpose
Contacting people in the borrower’s contact list for debt collection when they were not named as guarantors
Using a borrower’s photograph to harass or embarrass the borrower
Keeping access to the camera, gallery, contacts, or other protected resources after the relevant purpose has been completed, without another lawful basis
Disclosing a borrower’s loan, balance, default, identification data, or other personal information to uninvolved third parties
Using personal data for a purpose materially different from what was properly disclosed
Failing to provide understandable, accessible privacy information when the data is collected
Refusing to address a valid request concerning access, correction, blocking, erasure, or another applicable data-subject right

Limited access may be permissible when suitable, necessary, and proportionate—for example, allowing the borrower to select a chosen character reference or guarantor. But a character reference is not automatically a guarantor. A guarantor must expressly bind himself or herself to answer for the borrower’s obligation, and the lender must obtain the guarantor’s separate consent for processing.

What to do immediately

1. Preserve the evidence before blocking or uninstalling anything

Save the original material wherever possible:

Full screenshots showing the message, sender, date, and time
Screen recordings showing the account profile, conversation, and surrounding context
Original SMS, email, voicemail, call logs, and messaging-app conversations
URLs and screenshots of public posts, comments, group messages, or altered photographs
Names, usernames, telephone numbers, email addresses, payment accounts, and profile links used by the collector
The app’s exact name, developer, download page, version, and requested permissions
Privacy notice, terms and conditions, disclosure statement, loan agreement, repayment schedule, receipts, and account ledger
Messages sent to relatives, employers, co-workers, or other contacts
Written statements or affidavits from people who received the disclosure
Your written complaint to the lender and its response, if any
Proof of when each complaint was sent and received

Do not crop away information that identifies the account or establishes timing. Keep an untouched copy and a separate working copy for redaction. Export conversations when the platform allows it, and back up the files somewhere the app cannot access.

Ask recipients not to delete the messages. If a post is public, record the URL and capture it promptly because it may later be removed.

2. Reduce further access without destroying evidence

After preserving evidence:

Review the app’s permissions and revoke access that is no longer necessary, especially contacts, call logs, files, photos, camera, microphone, and location.
Change the password for the lending account and any reused passwords.
Enable multi-factor authentication on your email, social-media, and financial accounts.
Check for unfamiliar apps, device-administrator permissions, account logins, and forwarding rules.
Tell affected contacts that the messages did not come from you and ask them not to send money or provide personal information.
Report abusive posts or accounts to the relevant platform.

Uninstalling an app stops future device access in many cases but does not retrieve data already copied by the operator. Preserve evidence and account information first if it is safe to do so.

3. Write to the lender or its data protection officer

Send a concise written notice to the company and, if identified, its data protection officer. Include:

Your name and account or application reference
The app and company involved
A dated description of each incident
The telephone numbers, accounts, or agents involved
The personal data used or disclosed
The people who received the disclosure
The action you want, such as stopping third-party contact, removing an unlawful post, preserving records, correcting data, restricting processing, identifying the data source, or providing an account statement
A reasonable request for written acknowledgment and action

Do not send more identification documents than necessary. If identity verification is reasonably required, ask for a secure submission method.

This written notice is especially important for an NPC complaint. Under the NPC’s 2021 Rules of Procedure, a complainant generally must first inform the company or other concerned entity of the alleged privacy violation in writing. The company must be allowed to take appropriate action. Ordinarily, an NPC complaint may proceed if the response is untimely or inappropriate, or if there is no response within 15 calendar days after receipt.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal action. Explain and prove the urgent circumstances if you ask for a waiver.

Where to report

SEC: unfair collection by a lending or financing company

Use the SEC iMessage portal to submit a complaint or report. The SEC’s Financial and Lending Company Division also lists:

Email: flcd_complaints@sec.gov.ph
Telephone: (02) 8818-5990

Identify the actual corporation behind the app if possible. The app name may be different from the lender’s registered corporate name. Include the loan agreement, disclosure statement, payment record, screenshots, collector details, and your communications with the company.

You may also use SEC records and advisories to check whether the company has authority to operate as a lending or financing company. Registration as an ordinary corporation alone is not necessarily authority to conduct a lending business.

Ask for an acknowledgment or reference number, and keep it with your records.

NPC: misuse or unauthorized disclosure of personal data

Follow the NPC’s current complaint-filing instructions and use its official Complaints-Assisted Form.

A formal complaint generally must be:

In writing and signed
Verified, or submitted using the filled-out and notarized Complaints-Assisted Form
Accompanied by supporting evidence and any witness affidavits
Accompanied by the required certification against forum shopping
Filed by the affected data subject or a properly authorized representative

If someone files for you, a special power of attorney may be required. Additional authority documents apply when a juridical entity acts as representative.

The NPC presently lists filing personally, by registered mail, by courier, or by electronic mail when authorized by the Commission. Electronic documents must be digitally signed and should be in PDF format where practicable. Check the NPC page and the form immediately before filing because submission instructions may change.

Failure to attach evidence or comply with essential form requirements can cause outright dismissal. Do not rely on an informal social-media message to the NPC as a formal complaint.

The NPC states that its Complaints and Investigation Division has 30 calendar days from receipt to give due course to a complaint or dismiss it without prejudice. This is an initial action period, not a promise that the whole case will be resolved within 30 days.

If continued processing creates grave and irreparable harm, ask a lawyer whether an application for a temporary ban on processing is appropriate. That remedy has additional procedural requirements and may require a bond.

BSP: only when the provider is BSP-supervised

The SEC ordinarily regulates lending and financing companies. The BSP complaint route applies when the lender or financial service provider is a BSP-supervised financial institution, such as a bank or certain BSP-regulated non-bank entities.

First complain to the institution. If the issue remains unresolved, use the BSP Consumer Assistance Mechanism, including the BSP Online Buddy, or submit the official Complaints, Inquiries and Requests form:

Email: consumeraffairs@bsp.gov.ph
Telephone: (02) 5306-2584

Attach your complaint to the institution, its reply, and supporting documents. Do not send an SEC-regulated lending-company complaint to the BSP solely because the transaction involved an e-wallet or bank transfer.

Law enforcement: threats, extortion, impersonation, hacking, or other crimes

Report an immediate danger to the nearest police station or emergency services. For technology-facilitated offenses, you may also approach:

The NBI Cybercrime Division; the NBI directory lists ccd@nbi.gov.ph
An NBI regional or district office
The DOJ Office of Cybercrime, which lists cybercrime@doj.gov.ph and (02) 8524-8216

Bring identification and organized copies of the messages, account information, device or platform details, transaction records, and witness information. Preserve the original device and files when possible. The investigating authority or prosecutor—not the complainant—will determine which offense, if any, the evidence supports.

Administrative complaints to the SEC or NPC and a criminal complaint serve different purposes. One does not necessarily replace the other.

A practical complaint format

Use a chronological, factual account:

On [date and time], I received [number and type of communications] from [number/account/name]. The sender identified the lender or account as [details]. The message stated or showed [accurate summary]. On [date], the sender contacted or disclosed my information to [person or group], who is not my guarantor, through [channel]. The disclosed information included [data]. Attached are the original screenshots, conversation export, call log, witness affidavit, loan documents, and my written notice to the company. I request [specific relief].

Separate what you personally saw from what another person told you. Avoid exaggeration and do not label someone a criminal as an established fact. Let the documents show the conduct.

If the debt or amount is disputed

Ask the lender in writing for:

The registered corporate name and business address
Proof that it owns or is authorized to collect the account
A copy of the signed or electronically accepted loan agreement
The disclosure statement and itemized computation
The principal, interest, fees, penalties, payments, and current balance
The identity and authority of any third-party collection agency
Official payment channels and a proper receipt

Do not pay a personal account merely because a collector threatens you. Verify payment instructions through an independently confirmed company channel.

If you recognize the loan but cannot pay in full, you may propose a realistic written arrangement without admitting disputed charges. State which amounts you contest. Keep all offers, acceptances, and receipts.

A privacy or harassment complaint does not by itself cancel principal, interest, or other charges that are legally due. Conversely, owing money does not waive your privacy or permit abusive collection.

Common mistakes to avoid

Deleting or blocking messages before preserving them
Filing only against the app’s brand name without identifying the operating company
Sending a formal NPC complaint without first notifying the company in writing, unless a waiver is justified
Filing an unverified or unnotarized NPC complaint or omitting the certification against forum shopping
Submitting isolated screenshots that hide dates, sender details, or context
Posting your full identification, loan documents, or contact list publicly
Paying an unverified collector or personal account
Assuming every unpleasant reminder is legally actionable harassment
Ignoring a genuine court summons because earlier messages were abusive
Assuming a character reference is legally responsible for the debt
Reporting to only one regulator when the incident involves both unfair collection and misuse of personal data

When legal help is urgent

Seek prompt help from a Philippine lawyer, the Public Attorney’s Office if you qualify, or another appropriate legal-aid provider when:

A threat appears credible or refers to your home, workplace, children, or physical safety
Intimate images, altered photographs, identity documents, or sensitive records have been posted or threatened
Someone has accessed your email, social-media, e-wallet, bank, or mobile account
The harassment is causing loss of employment, serious reputational harm, or risk of self-harm
Many people are receiving disclosures or the material is spreading publicly
You receive a subpoena, summons, complaint, warrant, or other apparently official process
You need emergency relief to stop continuing disclosure or processing
The lender disputes the evidence, hides its identity, or appears to operate without authority
You are considering a civil or criminal case and need advice on parties, venue, prescription periods, and admissible electronic evidence

If distress becomes overwhelming, contact a trusted person and obtain immediate professional or emergency support. No collection dispute is worth risking your safety.

Frequently asked questions

Can an online lender contact everyone in my phone?

No. NPC rules prohibit unbridled or excessive processing of contact lists. For debt collection, the lender may contact a properly designated guarantor, but contacting other people in the borrower’s contact list for collection is prohibited. A character reference is not automatically a guarantor.

Can the lender contact my employer or relatives?

A lender may use contact information only on a lawful, necessary, and proportionate basis. Disclosing your debt to uninvolved employers, relatives, co-workers, or friends to shame or pressure you may support complaints for unfair collection and unlawful personal-data processing. The result can differ where the recipient is an actual co-borrower, authorized representative, or guarantor.

Does accepting the app’s terms allow it to use all my contacts and photos?

Not automatically. Consent must be informed and specific, and processing must still comply with lawful-purpose and proportionality requirements. A broad permission does not give the lender unlimited authority to harvest, disclose, or weaponize personal data.

Should I wait 15 days before reporting a threat to police?

No. The 15-day rule concerns the ordinary exhaustion requirement for a formal NPC privacy complaint. Report credible threats, extortion, hacking, or immediate danger to law enforcement without waiting. You may also ask the NPC to waive exhaustion when the requirements for a waiver are present.

Can I complain if I am only a contact person and not the borrower?

Yes, if your own personal data was processed or you received abusive communications. Explain how the lender obtained and used your information, state that you are not a guarantor if that is true, and preserve the messages. You may complain as the affected data subject.

Will filing a complaint erase the loan or stop collection?

Not necessarily. Regulators may address unlawful conduct, but a valid debt remains a separate issue. The lender may pursue lawful collection while complying with privacy, consumer-protection, and procedural rules.

Can a collector have me arrested simply because I missed a payment?

Ordinary nonpayment of a contractual debt does not by itself authorize a collector to order your arrest. Criminal liability depends on the elements of a specific offense and lawful proceedings. Do not ignore authentic court or prosecutor documents, but independently verify threats presented as warrants or criminal cases.

What if the app has disappeared?

Preserve the app name, developer, old download link, loan documents, payment accounts, messages, and the corporation named in the agreement or privacy notice. You may still report past conduct. Tell the regulator if the operator’s identity is unknown and provide every identifying detail available.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rights, liability, and procedure depend on the documents and facts. Official sources and complaint channels were checked on September 3, 2026.