Receiving threats, insults, public shaming, or messages sent to your relatives and co-workers because of an online loan can be frightening. A lender may demand payment of a legitimate debt, but it cannot use harassment, deception, unlawful threats, or misuse of your personal data to collect it. In the Philippines, you may report abusive online loan collection to the Securities and Exchange Commission, the National Privacy Commission, the Bangko Sentral ng Pilipinas, or law-enforcement agencies, depending on who made the loan and what the collector did.

When Online Loan Collection Becomes Abusive or Illegal

A debt collector may remind you of a due date, request payment, explain lawful consequences, and offer a restructuring arrangement. Collection crosses the line when the collector uses conduct prohibited by law or regulatory rules.

Common examples include:

Collection practice	Why it may be unlawful
Threatening physical harm, property damage, or violence	Prohibited under SEC collection rules and may constitute a criminal offense
Claiming that you will automatically be arrested or jailed for an unpaid loan	Misleading; the Constitution prohibits imprisonment merely for nonpayment of debt
Sending fake warrants, court summonses, police notices, or prosecutor documents	May involve false representation, forgery, intimidation, or other criminal conduct
Calling you names or using obscene, insulting, or degrading language	Prohibited as an abusive collection practice
Posting your name, photograph, ID, loan balance, or alleged “scammer” status online	May violate SEC rules, privacy law, and laws on defamation
Messaging everyone in your phone contacts	Generally prohibited when those people are not guarantors or co-makers
Contacting your employer, co-workers, friends, or relatives to shame you	May violate collection and data-privacy rules
Editing your photograph into a “wanted” poster or humiliating image	May create privacy, cybercrime, and defamation liability
Pretending to be a lawyer, police officer, court employee, or government agent	Prohibited deceptive collection and potentially criminal
Demanding payment through an unknown personal account without proof of authority	A warning sign of fraud or an unauthorized collector
Continuing to contact third parties after being told they are not guarantors	Strong evidence of harassment and excessive data processing

The fact that a borrower is late does not give a collector permission to humiliate the borrower. Even when payment is overdue, collection must remain lawful, truthful, proportionate, and directed primarily to the borrower.

Your Rights Under Philippine Law

A valid debt does not justify abusive collection

Article 1159 of the Civil Code provides that contractual obligations have the force of law between the parties and must be performed in good faith. This means a borrower generally remains responsible for a lawful loan even after filing a harassment complaint.

The same principle of good faith also limits how creditors exercise their rights. Articles 19, 20, and 21 of the Civil Code require people to act with justice, give everyone their due, and observe honesty and good faith. A person who unlawfully or willfully causes damage may be required to compensate the injured party. (Lawphil)

A complaint against a collector therefore addresses the method of collection, not necessarily the existence of the debt. You may dispute excessive charges, unauthorized transactions, or the loan itself, but those issues should be stated separately and supported by records.

SEC rules against unfair debt collection

The principal SEC rule is Memorandum Circular No. 18, Series of 2019. It applies to financing companies, lending companies, and third-party collection providers acting for them.

The circular prohibits practices such as:

Using or threatening violence or other criminal means;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language amounting to abuse;
Publishing or disclosing borrowers’ names and personal information except in legally permitted situations;
Communicating false credit information;
Using deception or false representations to collect a debt or obtain information;
Contacting people in the borrower’s contact list, other than guarantors or co-makers, even when the borrower previously allowed the app to access the phone; and
Collecting at unreasonable hours.

As a general rule, collection calls before 6:00 a.m. or after 10:00 p.m. are considered unreasonable. The circular contains limited exceptions, including certain accounts more than 15 days past due and situations where the borrower expressly agreed, through a written, electronic, or recorded form, that those hours were the only reasonable or convenient times. Those exceptions do not permit threats, profanity, deception, or public shaming.

A collection agency cannot avoid responsibility by saying it is independent from the lender. Under the circular, an outsourced collector acts as the financing or lending company’s agent, and the company retains ultimate responsibility for collection practices. Collectors must also disclose their full names or true identities.

SEC sanctions may include fines, suspension, and eventual revocation of the company’s authority, depending on the violation and whether it is a repeat offense. These administrative penalties are separate from possible civil or criminal liability.

Protection of your contacts, photographs, and other personal data

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal information to be processed lawfully, fairly, and only for a legitimate and proportionate purpose. (Lawphil)

The National Privacy Commission’s rules on loan-related transactions specifically restrict what online lending apps may collect and how they may use it.

An app must not require access to information that is unnecessary for the loan. In particular:

Access to a borrower’s contact list for debt collection or harassment is prohibited.
Harvesting contacts from email accounts or social-media accounts is prohibited.
An app should provide a separate method for the borrower to identify genuine guarantors, co-makers, or chosen references.
Camera or photo-gallery access used for identity verification should not remain active unnecessarily.
Photographs collected for verification cannot be used to embarrass or harass a borrower.
A lender remains accountable for personal information processed by its employees, contractors, and collection agencies.

A person listed merely as a character reference does not automatically become a guarantor. NPC Circular No. 2022-02 also requires appropriate notice to references and an opportunity for them to request removal of their information. A lender cannot treat every contact as someone it may pressure for payment. (National Privacy Commission)

You cannot be jailed merely because you failed to pay a debt

Article III, Section 20 of the 1987 Constitution states that no person shall be imprisoned for debt or nonpayment of a poll tax. An unpaid online loan, by itself, does not produce an arrest warrant or automatic criminal case. (Lawphil)

This does not mean every dispute involving a loan is immune from criminal investigation. A separate offense, such as estafa, requires proof of its own legal elements, including the particular deceit or fraudulent act alleged. A collector cannot truthfully say, “You will be arrested tomorrow,” simply because an installment is unpaid.

Threats of violence, coercion, persistent harassment, defamatory statements, or online publication may themselves fall under provisions of the Revised Penal Code and the Cybercrime Prevention Act of 2012, Republic Act No. 10175. The exact offense depends on the words used, the act committed, the medium, the intended victim, and the available evidence. (Lawphil)

Preserve Evidence Before Blocking the Collector

Evidence often disappears when a borrower immediately deletes the app, resets the phone, or blocks every number. Secure copies first.

Take complete screenshots. Include the collector’s number, account name, date, time, message, profile, and surrounding conversation. A cropped insult without the sender or date is less useful.
Make a screen recording. Scroll slowly through the conversation, app profile, payment page, loan details, permissions, and call history. This helps show that screenshots were not taken out of context.
Export or back up messages. Save copies to cloud storage, email, or another device. Preserve voice recordings, voicemail, social-media posts, email headers, and attached files.
Record calls when legally and safely possible. The Anti-Wiretapping Act imposes restrictions on secretly recording private communications, so do not assume every covert recording is admissible. Instead, save call logs and write a detailed note immediately after each call. When the collector’s system announces that the call is being recorded, note that fact.
Ask affected third parties for evidence. A relative, employer, or co-worker who received messages should keep the original conversation on their own device and provide screenshots. Their sworn statement may later be useful.
Create an incident log. Use one line for each call, text, post, or threat.

Date and time	Sender or number	What happened	Person contacted	Evidence filename
14 July 2026, 9:42 p.m.	09XX-XXX-XXXX	Threatened arrest and sent an edited photograph	Borrower	Screenshot-01
15 July 2026, 8:10 a.m.	“ABC Collections”	Messaged employer about loan	HR officer	Screenshot-02

Identify the company behind the app. Record the app name, developer, website, privacy notice, lending company’s legal name, SEC registration details, physical address, customer-service email, payment accounts, and any Certificate of Authority number shown.
Preserve proof of the loan. Save the loan agreement, disclosure statement, payment history, receipts, disbursement record, interest and fee computation, and your earlier requests for assistance.

After preserving evidence, revoke unnecessary permissions, change compromised passwords, strengthen privacy settings, and block abusive numbers where appropriate. Do not surrender remote access to your phone and never disclose a one-time password, PIN, or banking password.

Where to File a Complaint

More than one agency may have jurisdiction. You may file parallel complaints because each office addresses a different violation.

Situation	Appropriate office
Harassment by an online lending app, financing company, lending company, or collection agency	Securities and Exchange Commission
Misuse of contacts, photographs, IDs, location data, or other personal information	National Privacy Commission
Complaint against a bank, digital bank, e-money issuer, or another BSP-supervised institution	Institution’s customer-assistance channel, then Bangko Sentral ng Pilipinas
Credible threats, extortion, impersonation, doxing, fake legal documents, account hacking, or other suspected crimes	PNP Anti-Cybercrime Group, NBI Cybercrime Division, CICC, or local police
Immediate danger to life or property	Call emergency services or go to the nearest police station immediately

The brand shown on the app is not always the legal lender. Check the loan agreement and disclosure statement. A payment platform or e-wallet used to release funds is also not necessarily the creditor.

How to File a Complaint With the SEC

The SEC is generally the primary regulator for complaints involving non-bank lending companies, financing companies, online lending platforms, and their collection agencies. BSP’s consumer guide directs these complaints to the SEC’s Financing and Lending Company Division.

Step 1: File through the SEC I-Message portal

Use the official SEC I-Message Mo Portal and open a new ticket. Registration through the SEC’s online account system may be required. Select the category most closely related to financing and lending companies or unfair debt collection.

The SEC’s head office is at 7907 Makati Avenue, Salcedo Village, Barangay Bel-Air, Makati City 1209. Online filing is usually the most practical option, especially for borrowers outside Metro Manila or abroad. (Securities and Exchange Commission)

Step 2: Identify all responsible parties

State:

The legal name of the lending or financing company;
The online lending app or platform name;
The collection agency, if known;
The collector’s name, alias, number, email, or account;
The company’s SEC registration or Certificate of Authority number, if available; and
The names of third parties contacted.

Do not name only the app when the loan agreement identifies a separate corporation.

Step 3: Write a factual chronology

A useful complaint is specific and chronological. For example:

On 14 July 2026 at 9:42 p.m., a person using mobile number 09XX-XXX-XXXX claimed to represent ABC Lending Corporation. The collector stated that a warrant had already been issued and threatened to send my photograph to my employer. On 15 July 2026, my employer received the attached message disclosing my loan balance. My employer is not a guarantor or co-maker.

Avoid broad statements such as “They harass me every day” without dates, numbers, quotations, or attachments.

Step 4: Identify the rules violated

You may state that the conduct appears to violate SEC Memorandum Circular No. 18 because it involved, as applicable:

Threats of unlawful action;
False representation;
Insults or profane language;
Disclosure of personal or loan information;
Contact with people who were not guarantors or co-makers;
Unreasonable contact times; or
Conduct by a third-party collector for which the lender remains responsible.

You do not need to determine every possible offense. Describe the facts accurately and let the agency classify the violation.

Step 5: Attach organized evidence

Attach a copy of your government-issued ID, loan records, screenshots, call logs, payment receipts, third-party messages, correspondence with the lender, and your incident log. Label files clearly, such as “Annex A—Loan Agreement” and “Annex B—Message to Employer.”

Ask the SEC to investigate the company and collector, stop the prohibited practices, preserve relevant records, and impose appropriate administrative sanctions. Keep your ticket number and copies of everything submitted.

How to File a Complaint With the National Privacy Commission

File with the NPC when the collector accessed, copied, disclosed, or misused your contacts, photograph, ID, social-media information, workplace details, or other personal data.

Step 1: Obtain the current complaint-affidavit

Download the latest form from the NPC’s official complaint filing page. The NPC’s current instructions require the complaint form to be completed, printed, and notarized before submission. It may be filed personally, sent by courier, or scanned and emailed to complaints@privacy.gov.ph. (National Privacy Commission)

Use the latest form rather than an old version downloaded from an unofficial website. The March 2026 complaint-affidavit warns that an incomplete or insufficient complaint may be dismissed outright. It requires supporting evidence and a valid government-issued ID.

Step 2: Explain what personal data was misused

Identify:

What information the app collected;
How the app obtained it;
The permission the app requested;
Who received the information;
What the collector disclosed;
Why the recipient was not a guarantor or co-maker;
When you learned of the disclosure; and
How the misuse harmed or distressed you.

For example, distinguish between a collector sending a payment reminder directly to you and a collector sending your photograph and loan balance to 30 unrelated contacts.

Step 3: Name the personal information controller

The personal information controller is the person or organization deciding why and how personal data will be processed. This is often the lending or financing company, although the app operator, technology provider, and collection agency may also have relevant roles.

Use the corporate names in the loan agreement, privacy notice, app listing, SEC records, emails, and collection messages.

Step 4: Attach evidence and notarize the affidavit

Attach:

Screenshots of permissions and privacy notices;
Messages sent to contacts;
Statements from affected contacts;
Copies of public posts;
The loan agreement and app details;
Your communications asking the company to stop;
Evidence of emotional, reputational, employment, or financial harm, when relevant; and
A copy of your valid ID.

Sign the complaint before a notary public. Do not sign it in advance unless the notary instructs you to do so.

Step 5: Submit the complaint and follow payment instructions

The NPC’s current form lists its office at the 25th to 27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103. Confirm the address on the latest form before sending a courier package.

The NPC’s posted schedule sets a base filing fee of ₱500, with possible additional fees when damages are claimed. Qualified indigent litigants may be exempt. Follow the NPC’s current assessment and payment instructions rather than sending money without an official reference. (National Privacy Commission)

Complaints Against Banks, Digital Banks, and E-Wallet Providers

When the creditor is a bank, digital bank, e-money issuer, or another BSP-supervised financial institution, begin with the institution’s Financial Consumer Protection Assistance Mechanism. This is commonly its customer-service, complaints, or consumer-assistance unit.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, protects consumers against abusive debt-collection practices and requires financial service providers to protect client information. (Lawphil)

If the institution does not resolve the complaint, escalate it to the BSP through the BSP Online Buddy or by submitting the required consumer complaint form and proof that you first complained to the institution. Do not send your PIN, password, one-time password, complete card number, or other authentication credentials.

A company’s use of an e-wallet to release or collect payment does not automatically make the loan a BSP complaint. Determine which entity actually extended the credit.

When to Report the Collector to Police or Cybercrime Authorities

Consider a law-enforcement report when the conduct includes:

A credible threat to kill, injure, abduct, or damage property;
Extortion or a demand accompanied by unlawful threats;
A fake warrant, subpoena, court order, police notice, or prosecutor document;
Impersonation of a police officer, lawyer, judge, sheriff, or government employee;
Hacking, account takeover, identity theft, or unauthorized financial transactions;
Publication of defamatory allegations or humiliating edited images;
Repeated online harassment from multiple accounts;
Disclosure of home addresses or other information creating a safety risk; or
Threats involving children or vulnerable family members.

You may report cyber-related incidents to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or the Cybercrime Investigation and Coordinating Center. The BSP’s September 2025 consumer guide lists official channels for these agencies.

Bring or submit:

A valid ID;
The original phone or device when requested;
Printed and digital copies of evidence;
URLs, usernames, account identifiers, email headers, and phone numbers;
The incident log;
Loan and payment records; and
A sworn narration when required.

Do not edit the original files. Keep one untouched copy and a separate working copy. If a threat appears immediate, prioritize safety over completing an administrative complaint.

Do You Need to File at the Barangay First?

You do not need barangay conciliation before filing an administrative complaint with the SEC, NPC, or BSP.

Barangay officials may record an incident in the blotter or assist when the collector is an identifiable individual in the community. However, barangay conciliation generally does not apply when the respondent is a corporation or other juridical entity. It also has territorial and subject-matter limitations. (Lawphil)

A barangay blotter is not a substitute for a complaint to the proper regulator or police. Do not delay an urgent report merely to obtain a blotter entry.

Evidence and Document Checklist

Document or evidence	Practical purpose
Government-issued ID	Establishes the complainant’s identity
Loan agreement and disclosure statement	Identifies the creditor, amount, charges, and contractual terms
Proof of disbursement	Shows whether and how funds were received
Payment receipts and account history	Establishes payments and disputed balances
Complete screenshots	Shows the sender, content, date, time, and context
Call logs and contemporaneous notes	Records repeated calls and threats
Screen recordings	Preserves app pages and long conversations
Messages received by relatives or employers	Proves unauthorized third-party contact
Public-post URLs and downloaded copies	Preserves online publication before deletion
App-store listing and privacy notice	Identifies the operator and claimed data practices
Screenshots of app permissions	Supports allegations of unnecessary data access
Written complaint to the lender	Shows that the company had an opportunity to stop the conduct
Incident chronology	Helps investigators understand repeated events
Medical, employment, or financial records	May support claims of actual harm when relevant

Do not publicly upload an unredacted ID or loan document merely to expose the collector. Provide full copies only through official, secure complaint channels. Redact account numbers and unrelated personal information from copies sent to third parties.

Common Mistakes That Weaken a Complaint

Deleting everything before saving evidence

Collectors often change numbers, delete posts, or remove accounts. Preserve the original material before uninstalling an app or resetting a phone.

Filing a vague narration

Dates, exact statements, sender information, recipients, and attachments are more persuasive than conclusions such as “This company is a scam.”

Naming only the app

An app may be operated by one company while the loan is issued by another and collected by a third. Identify each entity and explain its role.

Combining every dispute into one unclear allegation

Separate your concerns:

The amount or validity of the debt;
Excessive or undisclosed charges;
Abusive collection;
Personal-data misuse; and
Possible criminal conduct.

Paying an unverified personal account

Before paying, request a current statement of account and verify the official payment channel directly with the lender. Obtain a receipt showing how the payment was applied.

Posting threats or personal information in retaliation

Do not threaten the collector, publish private information, or recruit others to harass the company. Retaliatory conduct can create a separate legal problem and distract from a valid complaint.

Assuming the complaint cancels the loan

Regulatory action against harassment does not automatically extinguish a lawful balance. Continue communicating through a safe, documented channel and request a realistic restructuring arrangement when necessary.

What Results Can You Expect?

Possible outcomes depend on the office and evidence involved.

The SEC may require an explanation from the company, investigate its collection practices, direct corrective action, or impose administrative sanctions.

The NPC may investigate unlawful personal-data processing, order compliance measures, address deletion or access requests, impose administrative penalties where authorized, or refer possible offenses for further action.

The BSP may facilitate or adjudicate qualifying consumer complaints involving supervised institutions under its consumer-protection framework.

Law-enforcement authorities may preserve digital evidence, identify account holders, investigate possible crimes, and refer a case for prosecution when supported by probable cause.

Administrative complaints do not always produce an immediate final ruling. Initial acknowledgment or referral may occur first, while a full investigation can take longer depending on the completeness of the filing, the company’s response, the volume of cases, and whether technical or third-party records must be obtained. Keep all reference numbers and follow up using the same case or ticket.

Filing From Abroad or as a Foreign National

An overseas Filipino or foreign national may still submit online complaints when the lender, collector, app operator, data processing, or harmful conduct has a sufficient connection to the Philippines.

For SEC complaints, the online I-Message portal is usually the simplest route.

An NPC complaint-affidavit must be properly notarized. A document signed abroad may need notarization before a Philippine embassy or consulate, or local notarization followed by an apostille when the country is a party to the Apostille Convention. Requirements can depend on the document and country, so confirm the acceptable form with the receiving agency before sending the original. Philippine consular officers may notarize affidavits intended for use in the Philippines. (Philippine Embassy in New Delhi)

When filing from another time zone:

State both the local time and Philippine time when relevant;
Preserve the international format of phone numbers;
Identify where you were located when the communication was received;
Provide a reliable email address and Philippine contact address, if available; and
Keep originals in case the agency later requires authentication.

A foreign borrower does not lose privacy protection merely because of nationality. Jurisdiction will depend more on the entities involved, where the processing occurred, and the connection of the conduct to the Philippines.

Frequently Asked Questions

Can an online loan collector contact my family?

A collector should not contact your entire family or phonebook to shame or pressure you. Contact with an actual guarantor or co-maker may be legitimate, but a relative does not become liable simply because their number was stored in your phone or listed as a character reference.

Can a collector call my employer?

A collector cannot disclose your debt to an employer merely to embarrass you or force payment. A narrowly necessary communication may be treated differently in unusual circumstances, but threats to expose you at work, repeated messages to co-workers, and disclosure of your balance are strong grounds for complaint.

Can an online lending app post my photograph on Facebook?

Using your photograph for a humiliating post, “wanted” image, or public debt-shaming campaign may violate SEC collection rules, the Data Privacy Act, and potentially laws on defamation or cybercrime. Save the URL, screenshots, account details, comments, shares, and date before requesting removal.

Can I complain even when I really owe the money?

Yes. A borrower’s default does not legalize harassment, threats, deception, or data misuse. Be truthful about the debt and focus the complaint on the prohibited conduct.

Can I be arrested for not paying an online loan?

You cannot be imprisoned merely for debt. A genuine criminal complaint requires an alleged offense with separate legal elements; it does not arise automatically from a missed payment. A collector cannot issue a warrant, and a real arrest warrant comes from a court.

Should I block the collector?

You may block abusive numbers after preserving the evidence and ensuring the lender has a lawful written channel for account communications. Consider sending one clear notice directing the company to stop third-party contact and communicate only through your chosen email or number.

Do I need a lawyer to file with the SEC or NPC?

A lawyer is not generally required for an initial administrative complaint. A clear chronology, properly completed form, correct respondent, and organized evidence are often more important. Legal assistance may become useful when substantial damages, criminal charges, court proceedings, or complicated jurisdictional questions are involved.

What if the lending app has disappeared?

Preserve the app name, screenshots, loan agreement, bank or e-wallet transaction records, payment accounts, emails, phone numbers, and app-store information. You may still report the matter to the SEC and NPC. NPC rules cover loan-related data processing even by persons acting without proper SEC authority, while suspected fraud or threats may also be reported to law enforcement.

Can I refuse to pay until the harassment complaint is resolved?

Filing a complaint does not normally suspend a valid debt. Request an itemized statement, dispute unauthorized charges in writing, and pay only through a verified official channel. You may also propose restructuring while expressly stating that payment discussions do not waive your complaint about abusive conduct.

Key Takeaways

A lender may collect a lawful debt, but it cannot use violence, unlawful threats, deception, profanity, public shaming, or indiscriminate contact with your phonebook.
Preserve complete evidence before deleting the app, blocking numbers, or resetting your device.
File with the SEC for unfair collection by lending or financing companies and their collection agencies.
File with the NPC when contacts, photographs, IDs, or other personal data were accessed, disclosed, or misused.
Use the lender’s complaint channel and then the BSP for complaints involving BSP-supervised institutions.
Report credible threats, fake warrants, impersonation, hacking, extortion, and other suspected crimes to cybercrime or police authorities.
You may complain even when the loan is overdue, but the complaint does not automatically cancel a valid debt.
Keep every ticket number, affidavit, attachment, receipt, and follow-up in one organized case file.