Quick answer

Online lenders may demand payment through lawful, reasonable means. They may not threaten violence or illegal action, use abusive language, publicly shame you, deceive you, or use your phone contacts and personal data to pressure you or people who did not guarantee the loan. These acts may violate the Data Privacy Act of 2012, the National Privacy Commission’s loan-processing rules, and the SEC’s prohibition on unfair debt collection practices.

Take these steps:

Preserve the messages, call logs, posts, app details, loan documents, and proof of disclosure before deleting anything.
Revoke unnecessary app permissions and secure your accounts after preserving evidence.
Send the lender and its Data Protection Officer a written complaint demanding that the harassment and unlawful processing stop.
Report unfair collection to the Securities and Exchange Commission (SEC) and privacy violations to the National Privacy Commission (NPC).
Report threats, extortion, impersonation, hacking, or immediate danger to the police or National Bureau of Investigation (NBI) without waiting for the lender to respond.

You may use several remedies at the same time. An SEC or NPC complaint does not automatically cancel a valid loan, but an unpaid balance does not give a lender permission to abuse, shame, or unlawfully expose you.

What conduct may be reported

Unfair debt collection

Under SEC Memorandum Circular No. 18, financing and lending companies—and collectors acting for them—must use fair and reasonable collection methods. Report conduct such as:

Threatening violence, property damage, reputational harm, or another criminal act;
Threatening arrest, imprisonment, prosecution, or another action the collector cannot lawfully take;
Using obscenities, insults, degrading language, or profanities to abuse the borrower;
Publishing or disclosing the borrower’s name or personal information, except where disclosure is specifically permitted by law;
Giving another person false loan information or failing to say that a debt is disputed;
Pretending to be a police officer, lawyer, court employee, government official, or another person;
Using false documents, deceptive demands, or fabricated case numbers;
Contacting people in the borrower’s phone list who were not named as guarantors or co-makers; or
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions where the account is more than 15 days past due or the borrower expressly agreed, through written, electronic, or recorded means, that those are the only reasonable contact times.

Even where an exception permits contact at a particular time, threats, deception, public shaming, and abusive language remain independently reportable.

Privacy violations

The NPC’s loan-related rules require transparency, a legitimate purpose, and proportionality. As clarified by NPC Circular No. 2022-02, an online lender may not conduct unnecessary or excessive processing merely because the borrower accepted an app’s terms.

Potential violations include:

Harvesting or copying the borrower’s phone or email contact list for debt collection;
Collecting social-media contacts or using them to shame the borrower;
Accessing photos, files, location data, messages, or other device information that is unnecessary for the disclosed purpose;
Using a photograph obtained for identity verification to embarrass or threaten the borrower;
Sending loan information, edited photographs, “wanted” posters, or defamatory collection messages to relatives, employers, co-workers, friends, or social-media contacts;
Continuing to use an app permission after its legitimate purpose has ended without prompting the user to revoke it;
Failing to provide an accessible privacy notice or a “just-in-time” notice explaining why particular information is being requested;
Using data for marketing, cross-selling, or unrelated third-party offers without a separate lawful basis;
Refusing to explain what data was collected, its source, how it was used, or to whom it was disclosed; or
Refusing a valid request to correct, block, or erase data that was unlawfully obtained or processed.

Consent is not a blank check. The NPC’s Guidelines on Consent state that a waiver of data-privacy rights, including the right to complain, is void.

Character references are not automatically guarantors

A character reference is generally provided to verify a borrower’s identity or the truthfulness of application information. The lender must tell the reference that they were named, explain how their details were obtained, and offer a way to remove their data as a reference.

A reference does not become responsible for the debt merely because their name or number was supplied. A guarantor, by contrast, must expressly bind themselves to answer for the borrower’s obligation, and the lender must obtain the guarantor’s separate consent. For debt collection, the NPC rules prohibit contacting people in the borrower’s contact list other than declared guarantors. An actual co-maker’s liability depends on the documents they signed.

What is generally lawful

Not every payment reminder is harassment. A lender may ordinarily:

Contact the borrower through reasonable channels;
State an accurate balance, due date, and contractual consequence of default;
Send a professional demand letter;
Contact a person who actually signed as guarantor or co-maker, within the limits of the law and the agreement;
Report accurate information through a legally authorized credit-reporting process; and
File a civil collection case and serve genuine court papers.

Whether a particular message is lawful depends on its wording, timing, recipients, accuracy, purpose, and the underlying loan documents.

What to do before blocking or uninstalling the app

1. Preserve the evidence

Keep the original device and messages when possible. Save:

Full screenshots showing the sender, phone number or account, date, time, and surrounding conversation;
Screen recordings showing how you opened the message, profile, post, app page, or permission screen;
Original text messages, emails, chat exports, voicemails, and call logs;
URLs and screenshots of public posts, including the account name and posting date;
Messages received by family, friends, employers, or other contacts;
The app-store page, developer name, package name, privacy notice, terms, and listed support information;
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and Data Protection Officer details;
Loan application, disclosure statement, promissory note, repayment schedule, receipts, transaction references, and account statements;
Proof that you disputed the debt or complained to the company;
Proof of delivery or receipt of your written complaint; and
A chronological incident log identifying each collector, number, account, act, recipient, and resulting harm.

Ask affected contacts to preserve what they personally received and, if willing, prepare signed statements. Avoid relying only on cropped screenshots; electronic evidence may need proof of authenticity and context under the Supreme Court’s Rules on Electronic Evidence.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally requires authorization from all parties, and the Supreme Court has applied it even to a participant who secretly recorded a private conversation in Ramirez v. Court of Appeals. Preserve existing voicemails and written communications instead.

2. Secure your phone and accounts

After documenting the app and its permissions:

Turn off access to contacts, photos, files, location, microphone, camera, SMS, and call logs unless still genuinely necessary;
Change passwords for email, social media, cloud storage, and financial accounts if compromise is possible;
Enable multi-factor authentication;
Review logged-in devices and revoke unknown sessions;
Warn affected contacts not to click links, disclose codes, or send money;
Report impersonating accounts and abusive posts to the relevant platform; and
Consider uninstalling the app only after preserving the evidence and obtaining any loan records available solely inside it.

Revoking app permissions does not erase copies the lender may already have. Your written notice should therefore address previously collected data as well.

Identify the operator and proper regulator

An app’s brand name may differ from the company that granted the loan. Check the disclosure statement, privacy notice, app-store developer page, payment instructions, and receipts.

A lending company must be a corporation with authority to operate from the SEC under the Lending Company Regulation Act. A certificate of incorporation alone is not a lending license. Use Check with SEC and record the result, but ask the SEC to confirm the current status if the name, app, or Certificate of Authority cannot be matched.

Situation	Primary reporting route
Lending or financing company; unfair collection or unauthorized lending activity	SEC
Unlawful collection, use, disclosure, or retention of personal data	NPC
Bank, digital bank, e-money issuer, or another BSP-supervised institution	Institution’s consumer-assistance mechanism, then BSP
Threats, extortion, impersonation, hacking, or other suspected crime	Police, NBI, or appropriate prosecutor
Abusive post or app-store violation	Platform or app store, in addition to government complaints

Send a written notice to the lender first

For an NPC complaint, the general rule is that you must first inform the lender, its Data Protection Officer, or the concerned entity in writing and give it an opportunity to act. The NPC may proceed if the entity does not take timely and appropriate action or does not respond within 15 calendar days from receiving your written notice.

Send the notice through an address shown in the privacy notice, loan documents, official website, or app. Use email or another method that produces reliable proof of receipt. Include:

Your name and enough account information to identify the transaction;
The app and corporate names;
A dated description of each incident;
The personal data involved and the people who received it;
A statement that you object to harassment and unauthorized processing;
A request to stop contacting anyone who is not a lawful guarantor or co-maker;
A request to identify the data collected, its source, purpose, lawful basis, recipients, retention period, and any third-party collector;
A request to correct inaccurate information and block or erase data unlawfully collected or processed;
A request to preserve collection logs, call records, account notes, disclosures, access logs, and instructions to third-party collectors;
The resolution you seek; and
A reasonable request for written confirmation of the action taken.

If the amount is disputed, say so clearly and identify why. Avoid admitting an amount you have not verified. Keep the message factual and attach copies rather than surrendering your only originals.

The NPC may waive the prior-notice requirement for good cause or a serious violation involving significant risk of harm, including grave and irreparable damage, the absence of an adequate remedy from the respondent, or patently illegal conduct. Explain and prove the urgency in the complaint. Do not wait 15 days before contacting law enforcement when safety is at risk.

How to file with the SEC

Use the SEC’s current iMessage ticketing system. After signing in through eSECURE, select “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.

Attach, as applicable:

Your completed complaint information and valid government-issued ID;
The app and respondent company’s names;
Loan documents and disclosure statement;
Receipts, payment records, and account statements;
Screenshots, messages, posts, and call logs;
Names or statements of affected contacts;
Your written complaint to the company and its response;
SEC registration or Certificate of Authority information; and
A clear description of the remedy requested.

Create a separate, clearly organized evidence set for each respondent company. Keep the iMessage ticket number and monitor the portal for requests to clarify or submit additional documents. The SEC iMessage user guide explains ticket creation and status tracking.

The SEC may investigate and impose administrative sanctions where supported by evidence, but its complaint process does not itself change payment terms, cancel the debt, declare the contract void, or rule that an interest rate is invalid. Those issues may require a negotiated settlement or court determination.

How to file a privacy complaint with the NPC

Complete the current form

Use the NPC’s current Complaint-Affidavit form dated March 2026. It asks for the respondent, personal data processed, exhaustion of remedies, alleged violations, chronological facts, evidence, and requested relief.

The complaint must generally be written, signed, verified, and accompanied by a certification against forum shopping. Attach:

Proof of your written notice and the company’s response, or proof that 15 calendar days passed without a response;
Documentary and electronic evidence;
Witness affidavits, where available;
Documents identifying the company or responsible officers;
A clear account of the data collected, used, or disclosed; and
The relief requested.

Insufficient form, failure to give the respondent an opportunity to act, insufficient supporting information, or inability to identify the parties may lead to outright dismissal. The governing procedure is in the 2021 NPC Rules of Procedure, as amended.

Submit and pay the required fee

The NPC permits filing personally, by registered mail, by courier, or by authorized email. Its current website directs complainants to send the notarized form and supporting documents to complaints@privacy.gov.ph. Electronic documents should be digitally signed and submitted in PDF format where practicable. Follow the NPC’s current complaint instructions, particularly if submitting large electronic evidence.

Under the current NPC fee schedule, the basic complaint filing fee is ₱500, with a legal-research fee of 1% of the filing fee but not less than ₱10. Additional fees apply to claims for damages and special applications.

An indigent litigant may seek exemption if:

Their gross income, together with that of their immediate family, does not exceed twice the applicable monthly minimum wage; and
They do not own real property with a fair market value, according to the current tax declaration, exceeding ₱300,000.

The fee schedule requires a barangay certificate of indigency, specified notarized affidavits, and the current tax declaration, if any. Confirm payment instructions and any revised fees with the NPC before submitting.

If a complaint is upheld, the NPC may enforce appropriate damages, administrative fines, and other sanctions. If it finds that criminal prosecution may be warranted, it may forward the record to the Department of Justice. A finding is not automatic; the result depends on the evidence and applicable legal elements.

If the lender is supervised by the BSP

If the actual lender is a bank, digital bank, non-bank electronic-money issuer, or another BSP-supervised institution, first complain through that institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism.

The BSP accepts escalations through BSP Online Buddy and other listed channels. Include your complaint to the institution, its response, the requested resolution, and supporting evidence. Use the BSP Verifier if you are unsure whether the company is BSP-supervised.

Privacy issues may still be reported separately to the NPC.

When to involve the police or NBI

Contact law enforcement promptly if messages or conduct involve:

A credible threat of physical harm, kidnapping, sexual violence, or property damage;
Extortion or a demand for money backed by an unlawful threat;
Hacking, account takeover, identity theft, or a loan obtained in your name without authority;
Impersonation of police, courts, lawyers, or government officials;
Threats to publish intimate or highly sensitive material;
Stalking or a dangerous visit to your home or workplace; or
Continued conduct that creates an immediate safety risk.

For an emergency, call the nationwide Unified 911 service, which is free and available 24/7 according to the Department of the Interior and Local Government.

For non-emergency cybercrime assistance, use the NBI’s online complaint page or approach its Cybercrime Division or a regional office. The NBI Cybercrime Division currently lists ccd@nbi.gov.ph as its official email. A report may need to be followed by a personal appearance, sworn statement, presentation of the original device, and additional evidence.

Do not arrange an entrapment, meet a threatening collector, or send money solely to obtain evidence without instructions from law enforcement.

Deal with the loan separately and safely

Harassment does not automatically extinguish the debt. At the same time, the existence of a debt does not excuse harassment.

Ask for a written, itemized statement showing principal, interest, fees, payments, and the current balance.
Compare it with the disclosure statement and loan agreement.
State any dispute in writing and keep proof that the collector received it.
Pay only through a verified company channel, not an individual collector’s personal account unless the company confirms that channel in writing.
Keep every receipt and transaction reference.
Obtain written settlement terms before paying a negotiated amount.
After full settlement, request written confirmation or a certificate of full payment.
Do not ignore genuine summonses, subpoenas, or court orders. Verify suspicious papers directly with the named court or government office using independently obtained contact information.

The Constitution provides that no person may be imprisoned merely for debt. Ordinary failure to pay a civil loan does not, by itself, authorize arrest. Separate conduct—such as an independently established criminal offense—must be assessed on its own facts. See Article III, Section 20 of the 1987 Constitution.

Common mistakes to avoid

Deleting messages, uninstalling the app, or resetting the phone before preserving evidence;
Keeping only cropped screenshots that omit the sender, date, time, or context;
Waiting for the lender’s response despite an immediate threat to safety;
Assuming an app-store report replaces an SEC, NPC, BSP, or police complaint;
Secretly recording private calls without considering the Anti-Wiretapping Act;
Publicly posting collectors’ personal information or making accusations that cannot be supported;
Sending IDs, one-time passwords, or financial credentials to an unverified collector;
Paying a personal e-wallet or bank account without written confirmation from the lender;
Treating a character reference as automatically liable for the loan;
Assuming acceptance of the app’s terms waived all privacy rights;
Filing a broad narrative without dates, recipients, documents, or proof; and
Ignoring follow-up notices from the regulator handling the complaint.

When legal help is urgent

Speak promptly with a Philippine lawyer, or the Public Attorney’s Office if you qualify, when:

There is a credible threat or continuing public disclosure;
Intimate material, identity documents, or financial credentials are involved;
The app appears unregistered or the true operator cannot be identified;
A large amount, property security, salary deduction, or alleged guaranty is disputed;
You want urgent injunctive relief, a cease-and-desist order, or a temporary ban on data processing;
You are considering damages or criminal charges;
You receive court papers or a prosecutor’s subpoena; or
Several agencies, companies, or cross-border operators are involved.

Special applications before the NPC may require additional fees, evidence, and a bond. Do not assume that a complaint alone immediately stops processing.

Frequently asked questions

Can I complain even if my loan is unpaid?

Yes. A borrower retains privacy and consumer-protection rights despite default. The debt and the collector’s conduct are separate issues.

May the lender contact my family, employer, or friends?

Not merely because their numbers appeared in your phone. Using contacts for debt collection, other than persons properly declared as guarantors—and, under applicable SEC rules, actual co-makers—is prohibited. A limited identity-verification inquiry to a properly named character reference is different from pressuring that person to pay or shame you.

Can a character reference file their own complaint?

Yes, if their personal data was collected, used, or disclosed in violation of their rights. They should preserve the messages they personally received and identify how the lender obtained and used their information.

Can the lender post my name or photograph online?

Public disclosure or publication to shame a borrower is generally prohibited. A photograph obtained for identity verification cannot lawfully be repurposed for humiliation. A specific disclosure required or authorized by law must be assessed separately.

Must I wait 15 days before going to the NPC?

The usual rule is to notify the respondent in writing and allow 15 calendar days from receipt for a response or appropriate action. The NPC may waive this requirement for proven good cause or a serious violation presenting significant harm. Police, NBI, SEC, platform, and emergency reports need not wait for this NPC period.

Will an NPC or SEC complaint erase my loan?

No. The SEC expressly does not cancel or settle loan obligations through its complaint process, and an NPC privacy complaint concerns data processing. Contract validity, the correct balance, and repayment may require separate resolution.

What if I never applied for the loan?

Tell the lender in writing that the account is disputed as possible identity theft. Request the application records and data source, avoid acknowledging the debt, secure your accounts, and report the matter to the police or NBI, NPC, and the appropriate financial regulator.

What if the app is unregistered?

Preserve proof of the app, operator, payment destination, and communications, then report it to the SEC. Lack of authority may lead to enforcement, but do not assume on your own that it resolves every contractual or restitution issue. Obtain legal advice before deciding how to handle any claimed balance.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the messages, loan documents, consent records, identity of the lender, and other evidence. Laws, fees, procedures, and agency channels were checked against official sources as of 6 August 2026.