Quick answer

Report abusive collection to the Securities and Exchange Commission (SEC) through SEC iMessage. Report the unlawful collection, use, or disclosure of personal data to the National Privacy Commission (NPC) using its current Complaint-Affidavit. Threats, blackmail, fraud, impersonation, or immediate safety risks should also be reported to the police, the NBI Cybercrime Division, or the DICT Cyber Hotline.

Before blocking numbers or uninstalling the app, preserve the messages, call logs, app permissions, privacy notice, loan documents, payment records, and proof that other people were contacted. For an ordinary NPC complaint, first notify the lender or its data protection officer in writing and allow up to 15 calendar days from receipt for an appropriate response. The NPC may waive this requirement for good cause or a serious, patently illegal violation involving grave or irreparable harm.

A borrower may still owe a valid debt, but that does not authorize threats, insults, public shaming, deceptive collection, or indiscriminate access to and use of phone contacts.

What online lenders and collectors may not do

The Financial Products and Services Consumer Protection Act prohibits abusive collection or debt-recovery practices and requires fair treatment, protection of client data, and a free internal consumer-assistance mechanism.

For SEC-regulated lending and financing companies, SEC Memorandum Circular No. 18, series of 2019 treats the following as unfair collection practices:

Using or threatening violence or other criminal means to harm any person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing the name or personal information of a person who allegedly refuses to pay, except where a lawful disclosure rule applies.
Giving another person loan information known, or which should be known, to be false—including omitting that the debt is disputed.
Using false representations or deceptive means to collect a debt or obtain borrower information.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions: the account is more than 15 days past due, or the borrower has given written, electronic, or recorded consent that those hours are the only reasonable or convenient time for contact. This exception concerns timing only; it never permits threats, shaming, deception, or abuse.
Contacting people in the borrower’s contact list other than the persons allowed under the governing rules.

The government’s 18 March 2026 Joint Advisory on Online Lending Platforms states the current rule directly: for debt collection, an online lender may contact only a guarantor, not other people in the borrower’s contact list.

A guarantor is not simply someone whose name was entered into an app. The person must have separately consented and expressly bound himself or herself to answer for the borrower’s obligation upon default. A character reference is not automatically a guarantor.

What is a privacy violation

The Data Privacy Act of 2012 requires personal data to be processed lawfully, fairly, for a specified legitimate purpose, and only to an extent that is adequate and not excessive.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

An app may not demand unnecessary permissions involving personal or sensitive personal information.
Access to contacts, a camera, or a photo gallery must be suitable, necessary, and proportionate to a legitimate stated purpose.
Camera or gallery access may be permitted for identity verification, know-your-customer checks, fraud prevention, or payment verification at the relevant stage. It must not be used to shame or embarrass a borrower.
Once a permission is no longer necessary, the app should turn it off or tell the user that it may be revoked.
Unconstrained or excessive processing of phone, email, or social-media contact lists is prohibited.
Limited contact-list access may be used to let the borrower select a character reference or guarantor, or to derive proportionate metadata for a legitimate purpose. It does not permit copying the list and messaging everyone.
A character reference may be contacted to verify identity or the truthfulness of information provided during the application. The lender must explain how it obtained the reference’s details and give the reference an option to have those details removed. The reference may not be contacted for debt collection, marketing, cross-selling, or unrelated offers.
Personal data may be retained only as long as necessary for its original purpose, legal claims, or a period required by law, after which it must be securely disposed of.

Examples worth reporting include:

Messaging relatives, friends, co-workers, customers, neighbors, or social-media contacts about the debt.
Creating group chats to shame the borrower.
Posting the borrower’s name, photo, identification document, address, workplace, alleged debt, or edited “wanted” image.
Using photos or contact information for a purpose that was never properly disclosed.
Continuing to use contacts or photographs after the relevant permission was no longer necessary.
Treating a character reference as a co-borrower or guarantor without separate consent.
Processing a non-borrower’s phone number or other personal data for collection and refusing to remove it.
Using pre-ticked boxes, concealed choices, or other deceptive interfaces to obtain purported consent.
Failing to provide an accessible privacy notice explaining the data collected, purpose, recipients, retention, and data-subject rights.

Clicking “Allow contacts” does not give the lender unlimited authority. SEC rules expressly restrict collection calls to other contacts notwithstanding purported borrower consent, while the Data Privacy Act still requires a lawful purpose, transparency, necessity, and proportionality.

Lawful collection is still allowed

Not every payment reminder is harassment. A legitimate lender may use reasonable and legally permissible means to collect an amount actually due. Depending on the facts and documents, it may:

Send respectful reminders and statements of account.
Contact a true guarantor.
Engage an identified collection agency or lawyer.
Make disclosures to authorized service providers, credit bureaus, regulators, or courts where legally permitted and appropriately protected.
Negotiate restructuring or settlement.
File a civil collection case.

The lender remains responsible for its employees and agents. It cannot avoid responsibility by saying that the abusive messages came from an outsourced collection agency.

A complaint also does not automatically cancel a valid loan, remove lawful interest, or stop a properly filed civil action. Separate disputes about the amount, undisclosed charges, payment posting, or loan validity should be stated clearly and supported by the agreement, disclosure statement, receipts, and account history.

What to do immediately

1. Address any urgent danger

For a credible threat of violence, stalking, doxxing that creates an immediate danger, or an attempt to enter your home or workplace, call the Philippines’ Unified 911 emergency hotline or go to the nearest police station.

Do not meet an unidentified collector alone. Tell a trusted person what is happening and preserve the location, number, account, or profile used by the person making the threat.

2. Preserve evidence before blocking or uninstalling

Save the original material and a backup. Useful evidence includes:

Screenshots showing the complete message, sender number or profile, date, and time.
The full conversation rather than selected lines only.
Call logs showing numbers, dates, times, frequency, and duration.
Voicemails and voice messages received through the app or messaging service.
Emails with full sender details and headers.
URLs and screenshots of public posts, comments, group chats, or altered images.
The app’s store listing, developer name, version, download URL, privacy notice, terms, and permissions.
Screen recordings of app pages, permissions, balances, transaction history, and collection notices.
Loan agreement, disclosure statement, promissory note, disbursement proof, statement of account, and payment receipts.
Messages sent to relatives, friends, employers, or other contacts. Ask each recipient to preserve the original message and provide a signed statement if willing.
Copies of complaints sent to the lender and proof of receipt.
A dated chronology identifying each incident and the people involved.

Do not secretly record a private telephone conversation without legal advice and the authorization required by law. The Anti-Wiretapping Act can apply even when the person making the recording participated in the conversation. Preserve recordings or voice messages that were lawfully created or voluntarily sent to you.

3. Secure your device and accounts

After documenting the app:

Revoke access to contacts, call logs, SMS, camera, microphone, location, storage, and photos unless access remains genuinely necessary.
Review your Google, Apple, email, social-media, bank, and e-wallet sessions.
Change passwords and enable multi-factor authentication where appropriate.
Tell affected contacts not to click links, send identification documents, disclose one-time passwords, or pay anyone.
Report unauthorized financial transactions immediately to the bank or e-money issuer.
Uninstall the app if it is no longer needed, but understand that uninstalling it does not erase data already copied to the lender’s systems.

4. Identify the actual company

Record both the app’s brand name and the corporate entity named in the loan agreement, privacy notice, payment instructions, or store listing. Check whether the company is registered and authorized through Check with SEC or ask the SEC through iMessage.

A certificate of incorporation alone is not necessarily authority to conduct a lending or financing business. Also watch for apps impersonating a legitimate company or directing payment to an unrelated personal account.

5. Send a written complaint and privacy request

Send the notice to the lender’s consumer-assistance unit, customer service address, compliance officer, and data protection officer if identified. Email, an in-app ticket, or registered mail can establish receipt.

I dispute and object to the following conduct: [state the exact acts, dates, numbers, recipients, and data used]. Stop all threats, public disclosure, contact-list collection, and contact with persons who are not lawful guarantors. Preserve all relevant records. Please identify the company and collector, explain the source, purpose, legal basis, recipients, and retention of my personal data, correct any inaccurate information, and confirm the action taken. I request a written response and ticket or reference number.

If you dispute the amount or say the transaction was unauthorized, identify the specific entries and attach proof. Republic Act No. 11765 requires a financial service provider, while investigating an alleged disputed amount or unauthorized transaction, to suspend the imposition of interest, fees, and charges or provide a similar reasonable accommodation. Whether this applies will depend on the nature of the dispute; it is not a general payment holiday for an admitted loan.

Where and how to report

SEC: unfair collection by a lending or financing company

Use the SEC’s official iMessage ticketing system. After creating or signing into an account:

Open a new ticket.
Select the Financing and Lending Companies Department.
Choose Complaints on Financing and Lending Companies.
State the app name, corporate name, account or loan reference, collector’s identity or number, dates, prohibited acts, people contacted, and the resolution requested.
Upload the loan documents, messages, call logs, payment proof, privacy notice, and prior correspondence.
Save the ticket number and use the same thread for additional evidence.

The SEC’s current hotline is 1-4732 (1-4SEC). The SEC may investigate, impose administrative sanctions, and, depending on the governing law and facts, fine, suspend, or revoke a company’s authority. Filing does not guarantee a particular sanction or individual compensation.

An unregistered or falsely identified lender should also be reported. Clearly label any apparent impersonation, unauthorized operation, fraudulent payment instruction, or identity theft.

NPC: unlawful use or disclosure of personal data

A borrower, character reference, guarantor, or any other person whose own data was unlawfully processed may file a privacy complaint. A non-borrower does not need to accept responsibility for the loan to complain about misuse of his or her phone number or identity.

For an ordinary formal complaint:

Notify the lender, collector, or other responsible entity in writing.
Wait for appropriate action or for 15 calendar days from its receipt without a response.
Download and complete the NPC’s current Complaint-Affidavit effective 1 July 2025.
Identify the respondent and the personal data processed. If the legal name is unknown, state the app, numbers, URLs, payment accounts, and other facts that may identify it.
Give a clear chronological narration and identify the relief requested.
Attach all supporting evidence, the written notice and response or proof of non-response, and a valid government-issued ID. Failure to attach supporting evidence can cause outright dismissal.
Complete the verification and certification against forum shopping, have the complaint notarized, and pay the applicable fee or submit the documents required for an exemption.
File it personally, by courier, or by emailing a scanned copy to complaints@privacy.gov.ph. Confirm current instructions through the NPC complaint page before submission.

Under the NPC Rules of Procedure, the Commission may waive the written-notice or 15-day requirement for properly established good cause or a serious violation, including grave and irreparable harm requiring NPC action, lack of an adequate remedy from the respondent, or conduct that is patently illegal. Explain and document the emergency instead of merely omitting the requirement.

The NPC’s published schedule of fees sets a ₱500 base complaint filing fee, plus the listed legal-research fee and additional fees when damages are claimed. Documented indigent litigants may qualify for an exemption if both the income and property requirements in the schedule are met. Check the complaint page for any later fee or payment update before filing.

Police, NBI, and DICT: threats, fraud, blackmail, or cybercrime

Administrative complaints do not replace an emergency or criminal report. The March 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491
Immediate danger: Unified 911 or the nearest police station

Describe what happened instead of insisting on a particular criminal charge. Whether threats, coercion, fraud, unlawful disclosure, identity theft, cyber libel, or another offense is established depends on the words used, intent, audience, evidence, and other facts.

BSP: only for a BSP-supervised provider

If the lender is a bank or another Bangko Sentral-supervised financial institution, first complain through that institution’s consumer-assistance mechanism. If unresolved, escalate through the BSP Online Buddy or another BSP Consumer Assistance channel. A completed CIR form may also be sent to consumeraffairs@bsp.gov.ph with the complaint submitted to the institution and its reply, if any.

The use of a bank account or e-wallet to disburse or collect payment does not by itself make an SEC-regulated online lending company a BSP-supervised lender.

What to request in your complaint

Choose remedies that match the evidence and the agency’s authority. You may ask for:

An end to abusive messages, public posts, and contact with non-guarantors.
Removal of your details as a character reference.
Identification of the lender, collector, and responsible corporate entity.
A statement of account and correction of inaccurate loan or payment data.
The source, purpose, lawful basis, recipients, last access, and retention period of your personal data.
Correction, blocking, deletion, or secure disposal where legally available.
Notice to previous recipients that inaccurate information has been corrected.
Preservation of records relevant to the complaint.
Internal investigation and a written explanation of corrective action.
Administrative sanctions, damages, or other relief available in the particular proceeding.

Deletion is not absolute. A lender may retain data that remains necessary to perform a valid contract, comply with law, or establish, exercise, or defend legal claims. It must still limit the data, protect it, and stop using it for unrelated or abusive purposes.

Common mistakes that weaken a report

Deleting messages or uninstalling the app before documenting it.
Submitting cropped screenshots that hide the sender, date, time, or surrounding conversation.
Filing only against the app brand without identifying the corporate operator where possible.
Combining several loans and companies into an unclear narrative.
Claiming every collection reminder is illegal instead of identifying the specific prohibited act.
Omitting proof that contacts or an employer actually received the disclosure.
Failing to notify the respondent in writing before an ordinary NPC complaint.
Paying an unidentified collector or personal account without verification and an official receipt.
Publishing unredacted IDs, phone numbers, loan documents, or other people’s messages while seeking help online.
Secretly recording calls without considering the Anti-Wiretapping Act.
Ignoring genuine court papers because a collector previously sent fake threats.

When legal help is urgent

Consult a lawyer promptly if:

Someone has made a credible threat against you, your family, home, or workplace.
Your identification documents are being used to obtain loans or open accounts.
An intimate image, altered photograph, home address, or sensitive personal information has been published.
You receive an authentic summons, subpoena, warrant, or court order.
The company disputes that its collector or payment account belongs to it.
Significant damages, lost employment, medical harm, or widespread disclosure resulted.
You need an urgent NPC temporary ban or court order.
Several proceedings involving the same incident are pending and the NPC certification against forum shopping must be completed accurately.
A filing deadline may be approaching.

Claims under Republic Act No. 11765 generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or material nondisclosure, with an absolute ten-year limit from the violation. Other privacy, civil, administrative, and criminal remedies have different periods. Do not treat those outer limits as a reason to delay; electronic evidence, accounts, and witnesses can disappear much sooner.

Frequently asked questions

Can a lending app contact my family, friends, or employer?

For debt collection, it may not use your contact list to contact people other than a true guarantor. A character reference may be contacted for application verification, not collection. Disclosing the debt to an employer, relative, or other third party may also violate confidentiality and privacy rules unless a specific lawful exception applies.

What if I clicked “Allow contacts”?

That is not permission to message everyone. The SEC rule restricts such contact notwithstanding purported borrower consent, and privacy law still requires a specific lawful purpose, necessity, transparency, and proportionality.

Can I be arrested merely because I did not pay an online loan?

No person may be imprisoned solely for debt under Article III, Section 20 of the Constitution. A lender may pursue a valid civil case. Separate conduct—such as independently provable fraud or another offense—must be evaluated on its own facts. A collector cannot issue a warrant or order an arrest.

Should I ignore every threat of a lawsuit?

No. A truthful statement that the lender may use an available legal remedy is not automatically harassment. A fabricated case number, fake warrant, false claim of automatic arrest, or threat of action the collector cannot legally take should be preserved and reported. Verify real court papers directly with the named court and obtain legal advice promptly.

Can a person who never borrowed file a complaint?

Yes, if that person’s own phone number, identity, messages, or other personal data were unlawfully processed. The person should preserve the message and file in his or her own capacity as the affected data subject.

Does filing a complaint stop payment obligations?

Not automatically. Continue to verify the balance and request lawful payment arrangements if the debt is admitted. Pay only through a verified company channel and obtain a receipt. State separately any dispute over an unauthorized loan, incorrect balance, undisclosed charge, or unposted payment.

Are screenshots enough?

They may be important evidence, but complete records are stronger. Preserve the full conversation, sender details, app and corporate identity, loan documents, recipient statements, proof of publication, and a chronological account.

Must I wait 15 days before seeking help?

The 15-day period ordinarily applies to exhaustion of remedies for a formal NPC complaint. It does not require you to delay an SEC report, secure your accounts, call 911, or report threats, fraud, or cybercrime to law enforcement. The NPC may also waive exhaustion requirements in serious or urgent cases when the grounds are properly alleged and supported.

Official legal and procedural references

This article provides general legal information, not advice for a particular case. Outcomes depend on the agreement, communications, identities of the parties, and available evidence. Laws, procedures, fees, and contact channels were checked against official sources on 23 August 2026.