Quick answer

You may report online lending app harassment to the regulator that supervises the lender and report misuse of personal data separately to the National Privacy Commission (NPC). If the conduct includes credible threats, extortion, impersonation of authorities, account intrusion, or immediate danger, report it promptly to law enforcement.

An unpaid loan allows a lender to demand payment and pursue lawful remedies. It does not permit threats, public shaming, deceptive collection tactics, abusive language, or indiscriminate use of your contacts, photos, and other personal data. The Financial Products and Services Consumer Protection Act prohibits abusive debt recovery practices, while SEC Memorandum Circular No. 18, series of 2019 and the NPC’s loan-processing rules provide more specific protections.

In most cases, take these steps:

Preserve the messages, posts, call records, app permissions, loan documents, and proof of disclosure to other people.
Revoke unnecessary app permissions after preserving the evidence.
Send a written complaint to the lender’s consumer-assistance unit and data protection officer.
Report unfair collection practices to the SEC, BSP, or CDA, depending on the lender.
File a privacy complaint with the NPC if personal data was accessed, disclosed, or used improperly.
Contact law enforcement immediately if there are credible threats or other possible crimes.

Reporting harassment does not automatically cancel a valid loan. Continue addressing the legitimate debt through verified, documented channels while disputing abusive conduct or incorrect charges separately.

What lenders and collection agents are not allowed to do

The SEC’s unfair-collection rules prohibit lending and financing companies—and their collectors—from engaging in conduct such as:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Disclosing or publishing a borrower’s name or personal information because of alleged nonpayment, except where disclosure is specifically permitted by law.
Giving third parties false loan information or failing to say that a debt is disputed.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting people in the borrower’s contact list who were not named guarantors or co-makers. The SEC rule treats this as unfair collection even if the borrower supposedly consented to contact-list access.
Using a borrower’s photograph to harass or embarrass the borrower.

The general rule under SEC Memorandum Circular No. 18 is that contact before 6:00 a.m. or after 10:00 p.m. is unreasonable. The circular contains exceptions where the account has been past due for more than 15 days or the borrower expressly agreed—through written, electronic, or recorded means—that those hours are the only convenient times. Those exceptions do not authorize threats, shaming, deception, or other abusive conduct.

The financial service provider remains responsible for its employees and agents. Under Republic Act No. 11765, it may also be solidarily liable with an accredited third-party service provider involved in debt collection.

When contact-list access becomes a privacy violation

The NPC Guidelines on Processing Personal Data for Loan-Related Transactions, as amended by NPC Circular No. 2022-02, require transparency, a lawful purpose, and proportionality.

An online lending app may not treat access to your phone as unlimited permission to collect or use everything stored there. In particular:

Permissions must be suitable, necessary, and not excessive for a legitimate loan-related purpose.
Processing through a permission should begin only when the information is actually needed.
Once access is no longer supported by a lawful purpose, the app should turn it off or inform the borrower that it may be revoked.
Camera or gallery access may be justified for identity or payment verification at a particular stage, but the borrower’s photograph cannot be used for harassment or public embarrassment.
Unbridled processing of contact lists is prohibited. This includes processing that leads to harassment, debt collection outside the borrower’s guarantors, or unfair collection practices.
Limited contact-list access may be allowed so a borrower can select a character reference or guarantor, or to derive proportionate metadata for a legitimate purpose. This is not permission to copy the entire list and send collection messages to everyone.
A character reference is not automatically a guarantor or co-maker. Liability for the debt ordinarily depends on the documents the person actually signed.
A lender must give borrowers clear, accessible information about how their data will be processed, including during collection.

Accepting an app’s general terms does not waive privacy rights or legal protections. Consent must be freely given, specific, and informed. A contract clause purporting to waive the protection of non-public client data or the right to have a complaint addressed is unenforceable under Republic Act No. 11765.

A lender may still retain or process information when supported by a contract, legal obligation, regulatory requirement, or the establishment or defense of a legal claim. Therefore, a request to erase every loan record may not be granted while the account remains active or a genuine dispute is pending. You may nevertheless demand that unlawful third-party disclosure stop and that unnecessarily collected contacts, photographs, or other data be erased or blocked.

Preserve evidence before blocking, uninstalling, or resetting the phone

Create a clear record of what happened. Preserve:

Screenshots showing the complete message, sender number or account, date, and time.
Screenshots or screen recordings of public posts, comments, edited photographs, or group messages. Include the profile name and full URL where available.
The app’s name, developer, download page, version, privacy notice, permission requests, and in-app collection messages.
The lender’s corporate name, SEC registration number, Certificate of Authority number, address, and collection agency, if shown.
Call logs, text messages, emails with headers, voice messages, and exported chat histories.
The loan agreement, disclosure statement, promissory note, repayment schedule, account statement, receipts, and proof of payments.
Proof that relatives, coworkers, employers, or other contacts received messages. Ask them to preserve the original messages and prepare a short factual statement identifying when and how they received them.
Proof of harm, such as employer communications, account-security alerts, medical records, or documented expenses, where relevant.
Copies of every complaint, demand, delivery receipt, automated acknowledgment, ticket number, and response.

Keep original electronic files. Store backups in a secure location and prepare a chronological incident list. Avoid reposting humiliating material publicly because doing so can spread the privacy violation further.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Preserve voicemails and recordings that were lawfully made.

If law enforcement may need to examine the device, do not factory-reset it. Ask the investigator before deleting the app or altering potentially important evidence.

Secure your phone and accounts

After preserving the evidence:

Revoke the app’s access to contacts, SMS, call logs, camera, microphone, location, photos, files, and social media unless continued access is necessary and lawful.
Check whether the app has device-administrator, accessibility, notification-reading, or “install unknown apps” privileges.
Remove sideloaded or suspicious apps. Export needed records before uninstalling the lending app.
Change passwords that were reused elsewhere and enable multi-factor authentication.
Review your email, social media, e-wallet, and bank accounts for unfamiliar sessions or transactions.
Contact the relevant bank or e-wallet immediately if there is an unauthorized transaction. A payment platform used to disburse a loan is not necessarily the lender itself.
Tell affected contacts not to engage with the collector, click links, send identification documents, or pay through an unverified personal account.

Send the lender a written complaint

Send the complaint to the lender’s consumer-assistance unit and data protection officer. Copy its official collections or compliance address if appropriate. Use an email, ticketing system, or courier service that gives you proof of receipt; do not rely only on an in-app message that may disappear.

A practical written notice may state:

Subject: Formal complaint—unfair collection and unauthorized use of personal data

I am [name], the borrower/data subject for account or application reference [reference].

On [dates and times], your company or collection agent [describe the messages, calls, threats, posts, or third-party contacts]. The personal data involved included [contacts, photograph, loan information, employer information, or other data].

I demand that you immediately stop all threats, abusive communications, public shaming, and disclosure of my loan information to unauthorized third parties. Please preserve all collection logs, call records, instructions to agents, data-access records, and communications relating to my account.

Please identify the legal corporate name of the lender, its Certificate of Authority, the collection agency and agents involved, and your data protection officer. Please also provide my account statement and the available information on what personal data was collected, its source, purpose, recipients, and date of disclosure.

I request the erasure or blocking of personal data that was unlawfully obtained, is excessive, or is no longer necessary, including improperly copied contact-list or photograph data. I also request written confirmation of the corrective action taken.

[If applicable: I dispute the following amount or entry: ________. This complaint is not a refusal to address any valid obligation.]

Please acknowledge receipt and respond in writing.

For an NPC complaint, this written notice is especially important. Unless the NPC waives the requirement, you must prove that you informed the respondent in writing and that it failed to take timely or appropriate action—or did not respond within 15 calendar days from receipt.

The NPC may waive exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or conduct that is patently illegal. Explain and document the urgency instead of simply omitting the prior notice.

Where to report

Main issue	Proper route
Lending or financing company, registered or unregistered online lending platform, unfair collection, missing authority or disclosures	Securities and Exchange Commission
Unauthorized access, copying, disclosure, retention, or misuse of personal data	National Privacy Commission
Bank, digital bank, e-money issuer, or another BSP-supervised institution	Institution’s FCPAM first, then BSP Consumer Assistance Mechanism
Credit or lending cooperative	Cooperative’s FCPAMS first, then Cooperative Development Authority
Credible threats, extortion, impersonation, account intrusion, or other possible crimes	Police or NBI; call 911 for immediate danger

More than one report may be appropriate. For example, contacting an entire phonebook to shame a borrower may support both an SEC unfair-collection complaint and an NPC privacy complaint.

How to file with the SEC

The SEC regulates lending and financing companies under the Lending Company Regulation Act and related laws.

First identify the actual company, not only the app’s brand. Its advertisements and online platform should display the corporate name, SEC registration number, and Certificate of Authority number. If these are missing or appear false, state that in the complaint.

You may file through the current SEC iMessage system. Select the Financing and Lending Companies Department and the service for complaints on financing and lending companies. The SEC also maintains a complaint guide and downloadable form. The official government directory identifies flcd_complaints@sec.gov.ph for lending complaints.

Attach:

The completed SEC complaint form.
A scanned valid government-issued ID.
The loan agreement, disclosure statement, repayment schedule, receipts, and account statement.
Screenshots, messages, call logs, posts, and proof of third-party contact.
The app name and legal company name.
The names or numbers used by collection agents.
A short chronological narration and the remedy requested.

The SEC’s published subject format is:

COMPLETE NAME_RESPONDENT COMPANY_SUBJECT OF COMPLAINT

The SEC sends a copy to the company for comment; its published procedure gives the company 10 days from receipt to answer. Preserve the SEC ticket or acknowledgment.

The SEC complaint process does not itself cancel the loan, rewrite payment terms, declare the contract void, or automatically invalidate an interest rate. Those forms of relief may require a different proceeding or court action. For claims specifically accruing under Republic Act No. 11765, the statute provides a five-year period from consummation of the financial transaction or discovery of deceit or nondisclosure, subject to an outside limit of 10 years from the violation. Other causes of action can have different periods, so do not delay.

How to file a privacy complaint with the NPC

Use the NPC’s current Complaint-Affidavit form. Follow the 2021 NPC Rules of Procedure, as amended.

The formal complaint should:

Be written, signed, verified, and notarized.
Identify the complainant and respondent—or provide facts that may lead to the respondent’s identification.
Describe chronologically what personal data was processed and how it was collected, accessed, used, or disclosed.
Identify the relief requested.
Attach supporting documents and witness affidavits where available.
Attach the written complaint previously sent to the respondent, proof of receipt, and its response or proof that 15 calendar days passed without an adequate response.
Include the required verification and certification against forum shopping.
Include a valid government-issued ID.

Submit the notarized complaint personally, by courier, or as a clear scanned copy to complaints@privacy.gov.ph. The current form lists the NPC at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103. Check the NPC complaint page before filing for any channel or form change.

The published NPC fee schedule provides a ₱500 complaint filing fee, plus a legal-research fee of 1% of the filing fee but not less than ₱10. Additional fees apply to claims for damages or special applications.

The schedule exempts qualified indigent litigants who meet both its income and property requirements and submit the prescribed documents. The published criteria refer to family gross income not exceeding twice the applicable monthly minimum wage and real property with a fair market value not exceeding ₱300,000.

A relative, coworker, or other person contacted by the app may file as an affected data subject if that person’s own data was processed or privacy rights were violated. A representative filing for a competent adult generally needs a special power of attorney.

If the lender is supervised by the BSP

Use this route only if the complained-of provider is a bank, digital bank, e-money issuer, or another BSP-supervised institution. An ordinary lending or financing company remains under SEC supervision even if loan proceeds were sent through a bank or e-wallet.

First report the concern to the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. If the response is unsatisfactory or the institution does not act, escalate through the BSP Consumer Assistance Mechanism.

The BSP’s current procedure allows escalation through the BSP Online Buddy or BOB chatbot. If BOB is unavailable, complete the BSP Complaint, Inquiry, or Reply form and email it with proof of the first-level complaint to consumeraffairs@bsp.gov.ph.

If the lender is a cooperative

Submit the complaint first to the cooperative’s Financial Consumer Protection Assistance Management System. If unresolved, elevate it to the Cooperative Development Authority’s consumer-assistance mechanism or the CDA Extension Office with jurisdiction over the cooperative. The CDA’s official contact page lists its current central and extension-office contacts.

A privacy complaint involving a cooperative may still be filed with the NPC.

When to contact law enforcement

Do not wait for the lender’s 15-day privacy-response period when there is immediate danger or a possible ongoing crime. Call 911 if a threat to life, safety, or property appears imminent.

Consider a prompt police or NBI report when the collector:

Makes a credible threat of physical injury or property damage.
Demands money by threatening to expose private, intimate, or fabricated material.
Pretends to be a police officer, prosecutor, judge, sheriff, or court employee.
Sends fabricated warrants, subpoenas, case numbers, or official-looking notices.
Gains unauthorized access to an account or device.
Publishes addresses, identification documents, children’s information, or other data in a way that creates an immediate safety risk.
Continues a coordinated harassment campaign using numerous accounts or numbers.

You may use the NBI Online Complaint page or seek investigative assistance from the NBI Cybercrime Division. Bring the original device, identification, a chronology, screenshots, loan records, and witness details. Investigators and prosecutors—not the borrower or lender—determine which criminal provisions fit the evidence.

The Constitution prohibits imprisonment for a purely civil debt. The Supreme Court has explained that the protection covers contractual civil debt. However, a separate criminal offense supported by distinct facts is not immunized merely because it arose from a financial transaction. Do not ignore authentic court papers; verify them directly with the named court and seek legal assistance.

Common mistakes that weaken a complaint

Deleting the app, chat, or account before preserving the evidence.
Submitting cropped screenshots that omit the sender, date, time, or surrounding conversation.
Naming only the app brand and not identifying the corporation or collection agency.
Sending an NPC complaint before completing the 15-day written-notice requirement without explaining grounds for a waiver.
Failing to attach proof that the lender received the written complaint.
Combining unrelated lenders into one confusing narrative.
Making broad accusations without stating who did what, when, where, and through which account or number.
Paying through an unverified personal account because of a threat.
Posting identification documents or humiliating messages publicly while asking for help.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Treating an administrative complaint as a substitute for answering an authentic summons, subpoena, or court order.
Assuming that reporting harassment automatically removes the underlying debt.

When legal help is urgent

Consult a lawyer promptly if:

You receive authentic court papers, a subpoena, or a demand requiring a time-sensitive response.
The lender disputes your identity or claims you obtained a loan you never applied for.
Intimate images, children’s data, home addresses, or government IDs were disclosed.
Harassment caused job loss, serious financial loss, medical harm, or a safety risk.
You want damages, an injunction, or relief beyond what an administrative complaint can provide.
Several proceedings involving the same facts are already pending, because the NPC requires disclosure through its certification against forum shopping.

Qualified persons may seek free legal assistance from the Public Attorney’s Office.

Frequently asked questions

Can a collector contact my relatives or employer?

A collector may communicate with a named guarantor or co-maker and may have limited lawful reasons to contact a borrower-selected character reference. It may not use a copied contact list to shame the borrower, reveal unnecessary loan information, or pressure unrelated relatives, coworkers, or employers. Whether a particular contact was lawful depends on the person’s role, the information disclosed, and the purpose and manner of the communication.

What if I allowed access to my contacts?

Permission is not unlimited consent. Collection and use must still be lawful, transparent, necessary, and proportionate. Contact-list processing that leads to harassment, debt collection outside permitted guarantors, or unfair collection remains prohibited.

Can I complain even if I am not the borrower?

Yes. If the app processed your phone number, name, messages, or other personal data and contacted or exposed you improperly, you may be an affected data subject. Preserve the message showing how your information was used.

Does revoking permission delete data already copied?

No. Revoking permission ordinarily prevents further device access but does not necessarily erase information already uploaded. Send a written access and erasure or blocking request, subject to any lawful retention ground.

Can the lender keep calling after I complain?

A complaint does not prohibit reasonable, lawful collection. Demand that future communication use a specified official channel and that harassment and unauthorized third-party disclosure stop. Preserve any violations that continue after notice.

Will an SEC or NPC complaint erase my debt?

No. These complaints address regulatory, consumer-protection, and privacy violations. The validity and amount of the debt remain separate questions unless the appropriate authority or court rules otherwise.

Can a collector have me arrested for nonpayment?

A private collector cannot issue a warrant or order an arrest. A purely civil debt does not result in imprisonment. Separate criminal allegations require lawful investigation and court process. Verify threatening documents directly with the court or agency named on them.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers, but keep at least one documented official channel open for legitimate account notices if possible. Tell the lender in writing which channel it should use.

Do I need a lawyer to file an administrative complaint?

Not ordinarily. SEC, NPC, BSP, and CDA mechanisms are designed to accept consumer complaints. Legal help becomes especially useful when court papers, significant damages, criminal allegations, emergency relief, or overlapping proceedings are involved.

Official references

This article provides general legal information, not advice for a specific case. Applicable remedies can depend on the loan documents, the lender’s regulatory status, the data processed, and the exact communications involved. Sources and procedures were checked on July 30, 2026; verify the linked agency pages for later changes before filing.