Quick answer

An online lender may demand payment and use lawful collection methods, but it may not threaten, insult, deceive, publicly shame, misuse your photo or personal data, or contact people in your phonebook who are not your guarantors or co-makers. Calls made before 6:00 a.m. or after 10:00 p.m. are generally prohibited, subject to limited exceptions.

If harassment is happening:

Preserve the messages, call logs, recordings, app details, loan documents, and proof of third-party contacts.
Tell the lender in writing to stop the abusive conduct, provide a complete account statement, and communicate only through a designated channel.
Revoke unnecessary app permissions and secure your accounts after preserving evidence.
Complain to the Securities and Exchange Commission (SEC) for unfair collection and to the National Privacy Commission (NPC) for misuse or disclosure of personal data.
Report credible threats, extortion, impersonation, stalking, or account intrusion promptly to the police or another competent law-enforcement office.

Harassment does not cancel a valid loan. Separate the collection misconduct from the question of how much, if anything, you legally owe.

What collectors are allowed—and not allowed—to do

Financing and lending companies, including collection agencies acting for them, may use reasonable and legally permissible means to collect an amount that is actually due. They must act in good faith and with reasonable conduct.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices include:

Threatening violence or other criminal means against you, another person, your reputation, or property
Threatening an action that cannot legally be taken
Using insults, obscenities, profanity, or language intended to abuse or humiliate
Disclosing or publishing a borrower’s name or personal information to shame the borrower, subject to narrowly defined lawful disclosures
Communicating false credit information or falsely representing the character, amount, or legal status of the debt
Pretending to be a court, law-enforcement officer, lawyer, or government official
Using deceptive means to collect or obtain information about the borrower
Contacting you before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days overdue, you expressly agreed to those hours, or those hours are the only reasonable opportunity for contact
Contacting people found in your phone contacts who were not named as guarantors or co-makers, even if the app obtained broad consent to access the phonebook

A financing or lending company remains responsible for the conduct of a collection agency or other third-party service provider it hired. It cannot avoid responsibility simply by saying that an outside collector sent the messages.

The broader Financial Products and Services Consumer Protection Act also prohibits financial service providers from employing abusive collection or debt-recovery practices. It requires fair treatment, protection of client data, and a free internal consumer-assistance mechanism.

Contacting family, friends, co-workers, or employers

Uploading your contacts does not give a lender unlimited authority to message everyone in your phone.

The NPC’s rules prohibit harvesting or copying contact lists, email lists, or social-media contacts for debt collection or harassment. Under NPC Circular No. 2020-01, an online lending app must provide a separate way for the borrower to identify chosen references or co-makers. The rule also prohibits using a borrower’s photo to harass or embarrass the borrower.

NPC Circular No. 2022-02 allows only limited access to the contact list when necessary for the borrower to select a reference or guarantor. It does not authorize debt collection from people who are not guarantors.

Important distinctions:

A guarantor or co-maker may have legal obligations depending on the signed agreement.
A character reference does not become liable for the loan merely because the borrower supplied the person’s name.
An ordinary contact, relative, friend, co-worker, or employer is not responsible for the debt simply because their number appears on the borrower’s phone.
Even a legitimate disclosure must have a lawful purpose and remain proportionate. Public shaming, mass messaging, and posting allegations on social media are not ordinary collection methods.

Ask every person contacted to preserve the original message, sender information, date, time, and screenshots showing the full conversation.

Do not panic over threats of arrest

The 1987 Constitution, Article III, Section 20 states that no person shall be imprisoned for debt. Mere inability or failure to pay an ordinary loan is generally a civil matter.

This does not mean every loan-related complaint is legally impossible. Criminal liability may arise from a separate criminal act, such as fraud, falsification, issuing a bouncing check under circumstances covered by law, threats, or unlawful access to an account. Whether such an offense exists depends on evidence—not on a collector’s text message.

A collector cannot issue an arrest warrant. Only a court can issue one under applicable legal requirements. Messages saying “you will be arrested today,” “the police are on the way,” or “a warrant has already been released” should be preserved and independently verified.

Do not ignore authentic court papers. A lender may file a civil collection case, and failure to answer a genuine summons can seriously affect your rights. Verify the case directly with the court named in the document instead of calling only the number supplied in the message.

What to do immediately

1. Preserve evidence before blocking or uninstalling the app

Save evidence in at least two secure locations. Keep:

Screenshots showing the full message, sender, date, and time
Call logs and voicemails
Original emails, including headers when available
Recordings lawfully made or received
Social-media posts, URLs, profile names, and screen recordings
Messages sent to relatives, references, co-workers, or employers
The app’s name, developer, download page, icon, version, privacy notice, and requested permissions
The lender’s corporate name, SEC registration number, Certificate of Authority number, address, and collection-agency details
Loan agreement, disclosure statement, promissory note, repayment schedule, and receipts
Proof of the amount actually released to you
A transaction history showing payments, deductions, fees, penalties, and the balance claimed
Copies of your written complaint and proof that the lender received it

Avoid cropping out details that establish authenticity. Keep an incident log listing each call, message, disclosure, threat, and person contacted.

2. Identify the actual lender

The app’s brand name may differ from the corporation that issued the loan. Check the agreement, disclosure statement, payment instructions, privacy notice, and app-store listing.

A lending company must be organized as a corporation and must have SEC authority to operate under the Lending Company Regulation Act of 2007. Report an app that conceals its operator, uses several changing names, or cannot show its authority.

Do not send additional money merely because a collector provides a personal bank or e-wallet account. Verify payment instructions through an official channel and demand an official receipt.

3. Send a written notice to the lender

Use the lender’s official consumer-assistance or data-protection contact. Keep the message factual. State:

Your name and account or loan reference
The dates and nature of the harassment
The numbers, accounts, or collection agents involved
The names of third persons contacted
That you dispute any inaccurate balance or representation
That you require abusive conduct and unauthorized disclosure to stop
That future communication should use a specified channel and reasonable hours
That you want a complete statement of account and the identity and authority of the collecting entity
That relevant records must be preserved

For a privacy complaint, specifically ask the lender or its data protection officer to explain what personal data it collected, the source and purpose of the data, the recipients, the retention period, and the action taken to stop further unauthorized processing.

Do not falsely deny a loan you actually obtained. If the balance is disputed, say exactly why—for example, uncredited payments, undisclosed deductions, unexplained fees, or a different amount released.

4. Secure your phone and accounts

After saving evidence:

Revoke the app’s access to contacts, photos, files, camera, microphone, location, and other permissions that are unnecessary
Change passwords for your email, app store, social media, and financial accounts
Enable multi-factor authentication
Review logged-in devices and revoke unfamiliar sessions
Warn affected contacts not to click links, share verification codes, or send money
Ask social-media platforms to remove impersonation or unlawful disclosures
Run a reputable security scan if you suspect unauthorized access

Uninstalling an app does not necessarily erase data already copied to the lender’s systems. Requesting deletion may also be subject to legitimate retention duties, such as keeping records necessary for an existing contract, legal claim, or regulatory requirement.

Filing a complaint with the SEC

For a lending company, financing company, online lending platform, or its collection agency, file through the SEC iMessage system. The SEC describes iMessage as its central online channel for complaints, inquiries, and requests and provides a ticket for tracking the submission.

The SEC’s complaint guidance for financing and lending companies instructs complainants to:

Complete the prescribed complaint form accurately
File one complaint form for each respondent company
Attach a valid government-issued ID
Attach the loan documents and all available supporting evidence

Name both the app and the corporation behind it when known. Identify the collection agency, phone numbers, and accounts used. Describe each incident by date rather than merely stating “they harassed me.”

The SEC can investigate regulatory violations and impose appropriate sanctions, but its complaint office does not itself cancel the debt, rewrite payment terms, declare the contract void, or conclusively determine that an interest provision is invalid. Those issues may require a court or another forum with jurisdiction.

Filing a privacy complaint with the NPC

Use the NPC process when the lender or collector:

Accessed or copied contacts beyond what was necessary
Messaged people who were not guarantors
Posted or circulated your name, photo, ID, debt, or other personal data
Created a group chat to shame you
Used your photo or social-media information to threaten or humiliate you
Refused to address an access, correction, objection, or deletion request
Continued unauthorized processing after being notified

Ordinarily, you must first notify the lender, its data protection officer, or the responsible entity in writing and allow it an opportunity to act. Under the NPC’s amended 2021 Rules of Procedure, a complaint generally will not be given due course unless the entity failed to take timely appropriate action or failed to respond within 15 calendar days after receiving your written notice. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm or conduct that is patently illegal.

A formal complaint must satisfy the NPC’s procedural requirements. It generally must be written, signed, verified, properly supported, and accompanied by relevant correspondence and a certification against forum shopping. The NPC provides a complaint-affidavit form and current submission instructions on its official complaint page.

Do not wait 15 days if there is an immediate threat to safety. The internal-notice requirement concerns the ordinary NPC process; it does not prevent an urgent report to law enforcement.

When to contact law enforcement urgently

Seek immediate help if a message contains a credible threat of physical harm, sexual violence, kidnapping, property damage, stalking, or violence against a family member. Also report suspected extortion, identity theft, account takeover, hacking, impersonation of police or court personnel, or publication of intimate material.

Preserve the original communication and bring identification, a written timeline, device information, and copies of the evidence to the nearest police station or appropriate cybercrime unit. If danger is immediate, contact emergency services and move to a safe place.

Regulatory complaints and criminal reports serve different purposes. Filing with the SEC or NPC does not prevent you from reporting conduct that may constitute a crime.

Handling the loan while the complaint is pending

If you recognize the loan but cannot pay the full amount, request a written restructuring or settlement proposal. Ask for:

The principal amount released
Every payment credited
Interest and penalty calculations
All service, processing, collection, and other fees
The current payoff or settlement amount
The deadline and official payment channel
Written confirmation of any waiver or revised terms
A receipt and certificate or confirmation of full payment once settled

Do not rely on a collector’s verbal promise. Paying a random amount may not settle the account unless the lender confirms the arrangement in writing.

If you dispute the debt, request documents establishing the loan and the collector’s authority. An unknown debt may involve mistaken identity or identity theft. Do not provide additional IDs, selfies, passwords, one-time PINs, or contact lists merely to “verify” yourself through an unconfirmed account.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence
Fighting with collectors using threats or abusive language
Posting unredacted IDs, contracts, phone numbers, or account details publicly
Paying into a collector’s personal account without verification
Assuming that harassment automatically erases the debt
Assuming that a demand letter is already a court order
Ignoring a real summons because earlier messages were fake
Filing a complaint that does not identify the legal company behind the app
Submitting vague allegations without dates, screenshots, or supporting documents
Waiting for the harassment to escalate before securing accounts and warning contacts
Filing an NPC complaint without first sending written notice, unless facts justify waiver of that requirement

When legal help is especially important

Consult a Philippine lawyer promptly if:

You received an authentic summons, subpoena, court order, or demand involving collateral
The loan was secured by a mortgage, vehicle, salary arrangement, or postdated checks
The amount claimed is substantial or the computation is unclear
Your identity appears to have been used for a loan you did not obtain
Private, intimate, medical, financial, or government-ID information was published
A collector caused job loss, serious reputational harm, or measurable financial damage
You are considering a civil action or criminal complaint
You are being asked to sign a waiver, compromise, acknowledgment, or new promissory note

A lawyer should examine the actual agreement, disclosure statement, payment record, and communications before advising whether particular charges, contractual provisions, or claims are enforceable.

Frequently asked questions

Can an online lender call my employer?

It depends on the purpose and the person’s legal role. Contacting an employer merely to disclose or shame you about a debt can violate collection and privacy rules. An employer does not become liable for your loan. Different considerations may apply if the employer is a properly designated contact or is involved in a valid payroll arrangement, but disclosure must still be lawful and proportionate.

Can collectors message my relatives?

Not merely because their numbers were copied from your phone. A named guarantor or co-maker is different from an ordinary relative. Mass messaging relatives or using them to shame or pressure you should be documented and reported.

Can the app post my photo and label me a scammer?

Using a borrower’s photo to harass or embarrass the borrower is prohibited by NPC rules. Publishing accusations may also raise additional privacy, civil, or criminal issues depending on the content and circumstances.

Is calling after 10:00 p.m. always prohibited?

It is generally an unfair collection practice, but SEC MC No. 18 recognizes limited exceptions when the account is over 15 days past due, the borrower expressly consented to those hours, or those hours are the only reasonable opportunity for contact. Those exceptions do not authorize threats, insults, deception, or public shaming.

Does consenting to phone permissions make contact blasting legal?

No. Broad app permission or consent does not authorize contacting everyone in your phonebook. SEC and NPC rules specifically restrict the use of contact lists and require the borrower to choose references or guarantors through a separate interface.

Can I stop paying because the lender harassed me?

Harassment and repayment are separate legal questions. Report the misconduct, but do not assume it extinguishes a valid obligation. Obtain a statement of account and legal advice if the balance or contract is disputed.

Can I be arrested for an unpaid online loan?

Not for the debt alone. The Constitution prohibits imprisonment for debt. A separate criminal allegation must have its own legal and factual basis, and a collector cannot issue a warrant.

Which agency should receive my complaint?

For an SEC-regulated lending or financing company, use the SEC for unfair collection or licensing concerns. Use the NPC for personal-data misuse or disclosure. If the provider is a bank or another BSP-supervised institution, first use its consumer-assistance mechanism and then the appropriate BSP complaint process if unresolved. Report credible crimes or immediate threats to law enforcement. The same incident may properly be reported to more than one agency because each has a different role.

Official sources

This article provides general legal information, not advice for a particular loan, complaint, or court case. Legal rights and remedies depend on the agreement, evidence, identity of the provider, and specific conduct involved. Official sources and procedures were checked as of July 27, 2026.