If an online lending app is threatening you, calling your relatives, posting your photo, messaging your employer, or shaming you on social media, you are not powerless. In the Philippines, unpaid debt is normally a civil matter, but harassment, threats, debt-shaming, unlawful use of contacts, and deceptive collection tactics can be reported to government agencies. The usual complaint routes are the Securities and Exchange Commission (SEC) for unfair debt collection, the National Privacy Commission (NPC) for misuse of personal data, and the NBI, PNP Anti-Cybercrime Group, or DICT Cyber Hotline for threats, scams, fraud, or cyber harassment. A March 2026 public advisory from the DICT, NPC, and SEC specifically recognized reports of online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data.

What Counts as Online Lending App Harassment?

Online lending app harassment is not just “makulit na paniningil.” Lenders may demand payment, send reminders, and pursue lawful collection. What they cannot do is use abusive, deceptive, humiliating, or unlawful methods to force payment.

Under SEC Memorandum Circular No. 18, Series of 2019, financing companies, lending companies, and their third-party collection agents are prohibited from unfair debt collection practices. The circular covers acts such as threats of violence or criminal means, threats to take action that cannot legally be taken, use of insults or profane language, disclosure or publication of a borrower’s personal information, false representations, contacting people about loan information in improper ways, and contacting borrowers at unreasonable hours.

Common examples include:

“Ipapahiya ka namin sa Facebook.”
“May warrant ka na bukas.”
“Pupuntahan ka ng pulis.”
“Ipapadala namin sa HR ninyo ang utang mo.”
Sending your photo, ID, or loan details to your contacts.
Calling your parents, siblings, co-workers, neighbors, or employer even if they are not guarantors.
Creating group chats to shame you.
Posting you as a “scammer” without a court judgment.
Threatening arrest for non-payment of a loan.
Calling late at night or very early in the morning.
Pretending to be a police officer, court sheriff, lawyer, barangay official, or government employee.

The 1987 Constitution also states that no person shall be imprisoned for debt. This means a lender cannot truthfully say that you will be jailed merely because you failed to pay a loan. Fraud, falsification, or bouncing checks may create separate legal issues, but ordinary non-payment of a loan is not, by itself, a reason to arrest or imprison someone. (Supreme Court E-Library)

Your Main Legal Rights as a Borrower

You have the right not to be publicly shamed

A lender may collect a lawful debt, but it cannot humiliate you into paying. Publicly posting your name, photo, ID, address, employer, contact list, or loan details can violate SEC rules on unfair collection and may also raise privacy, civil, or criminal issues depending on the facts.

You have the right to privacy over your contacts and personal data

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal data processing to follow the principles of transparency, legitimate purpose, and proportionality. In simple terms: the lender must tell you what data it collects, use it for a lawful and specific purpose, and collect only what is necessary. (Lawphil)

The NPC’s loan-related data privacy rules apply to loan processing activities by lending and financing companies, including online lending apps and their service providers. NPC Circular No. 20-01 states that entities processing borrower data for loan activities are personal information controllers and must protect personal data and uphold data subject rights. (National Privacy Commission)

The 2026 DICT-NPC-SEC advisory is especially clear: unnecessary app permissions, excessive access to contact lists, and contacting people in the borrower’s contact list other than named guarantors are prohibited. For debt collection, lending and financing companies may contact the guarantor, but not ordinary phone contacts who did not agree to be responsible for the loan.

You have the right to know the true cost of the loan

Under the Truth in Lending Act, or Republic Act No. 3765, creditors must give a clear written statement of finance charges, including the finance charge in pesos and centavos and the simple annual rate. This matters because many online lending complaints involve very short loan terms, high deductions, hidden service fees, and penalties that were not clearly disclosed before release of the loan. (Lawphil)

You have the right to complain even if you still owe money

A pending balance does not give a lender permission to harass you. Your complaint is about the method of collection, misuse of data, threats, or illegal conduct. The debt issue and the harassment issue are separate. You may still need to address a valid loan obligation, but the collector must follow the law.

Where to File a Complaint Against an Online Lending App

Problem	Primary office to approach	Best for
Threats, insults, public shaming, abusive collection, fake legal threats	SEC Financing and Lending Companies Department / FINLEND	Unfair debt collection by lending or financing companies and online lending platforms
Accessing your contacts, messaging your contacts, using your photo/ID, excessive app permissions	National Privacy Commission	Data privacy violations and unlawful personal data processing
Threats, extortion, fake warrants, fake police/court messages, online impersonation, cyber harassment	DICT Cyber Hotline, NBI Cybercrime Division, PNP Anti-Cybercrime Group	Criminal or cybercrime-related conduct
Bank, digital bank, e-money issuer, pawnshop, payment operator, or other BSP-supervised entity	Bangko Sentral ng Pilipinas consumer channels	Complaints involving BSP-supervised financial institutions
Immediate physical danger	Local police station, barangay, or emergency responders	Safety and urgent intervention

The 2026 DICT-NPC-SEC advisory lists the SEC iMessage portal for unfair debt collection complaints and gives the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group as reporting channels for harassment, threats, frauds, and scams. For BSP-supervised institutions, the BSP lists its Consumer Protection and Market Conduct Office channels for unresolved complaints involving banks, money service businesses, non-bank e-money issuers, operators of payment systems, pawnshops, and similar entities. (Bureau of the Treasury)

Step 1: Preserve Evidence Before Blocking or Deleting Anything

Before you block the numbers, uninstall the app, or delete conversations, preserve the evidence. Complaints are much stronger when you can show exactly what happened, when it happened, who sent it, and how it affected you.

Collect:

Screenshots of all messages
- Include the sender’s number, username, profile, date, and time.
- Take full-page screenshots where possible.
- Do not crop out important context.
Call logs
- Screenshot repeated calls.
- Note calls made before 6:00 a.m. or after 10:00 p.m., because SEC rules treat unreasonable contact hours as an unfair collection issue in specified circumstances.
Voice recordings or voicemail
- If you have recordings, keep the original files.
- Write a transcript if the audio is unclear.
Proof that they contacted other people
- Ask relatives, friends, co-workers, or employers to send screenshots.
- Get the sender’s number, message content, date, and time.
- If possible, ask them to write a short statement describing what they received.
Loan documents
- Loan agreement.
- Disclosure statement.
- App terms and conditions.
- Privacy policy.
- Payment schedule.
- Screenshots showing the amount borrowed, amount released, interest, fees, penalties, and due date.
App information
- App name.
- Developer name.
- Website.
- Google Play or App Store link.
- Corporate name, if shown.
- SEC registration number or Certificate of Authority, if available.
Proof of public shaming
- Screenshots of posts, comments, group chats, or messages.
- Links to social media posts.
- Names or usernames of accounts used.
- Screenshots showing who could view the post.

Create a simple timeline. Example:

Date and time	What happened	Evidence
June 3, 9:15 p.m.	Collector texted threat to post my ID	Screenshot A
June 4, 7:30 a.m.	Collector messaged my sister about my loan	Sister’s screenshot B
June 4, 11:40 p.m.	Repeated calls after 10 p.m.	Call log C
June 5, 2:00 p.m.	My photo was posted in a Facebook group	Screenshot and link D

This timeline helps the SEC, NPC, NBI, PNP, or prosecutor understand the pattern quickly.

Step 2: Identify the Real Company Behind the App

Many online lending apps use one name in the app store and another name in the loan agreement. Some use several brand names under one company. Others hide behind collectors, agents, or fake “legal departments.”

Look for:

The name in the loan agreement.
The company name in the disclosure statement.
The privacy policy.
The app developer name.
The payment recipient name.
The SMS sender name.
The bank, e-wallet, or payment account where you are asked to pay.
Any SEC registration number or Certificate of Authority.

Under Republic Act No. 9474, a lending company must be a corporation and cannot conduct lending business unless granted authority to operate by the SEC. The law also gives the SEC regulatory and supervisory powers over lending companies, including authority to impose administrative sanctions such as suspension or revocation of authority and fines. (Supreme Court E-Library)

For financing companies, Republic Act No. 8556 gives the SEC authority to enforce the Financing Company Act, subject to BSP authority for financing companies with quasi-banking functions. (Bureau of the Treasury)

If you cannot identify the company, do not give up. File using the app name, phone numbers, payment channels, screenshots, and any names used by collectors. Regulators may still trace the operator through the details you provide.

Step 3: File a Complaint with the SEC for Unfair Debt Collection

For harassment by a lending company, financing company, or online lending platform, the SEC is usually the first agency to approach.

The SEC’s current public ticketing system is iMessage, which the SEC describes as its official web-based platform for public inquiries, complaints, incidents, and requests. It generates an electronic ticket and allows users to track ticket status. (Securities and Exchange Commission) The SEC user guide states that users can open a new ticket, agree to the privacy policy, sign in with eSECURE, choose the appropriate service, fill out the form, upload files if needed, and create the ticket. (Securities and Exchange Commission) The service list includes “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department. (Securities and Exchange Commission)

Practical SEC filing steps

Go to the SEC iMessage portal.
Create or sign in using your eSECURE account.
Choose the service related to Complaints on Financing and Lending Companies.
Fill in your personal details and contact information.
Identify the lending app and company as completely as you can.
Write a clear complaint narrative:
- When you borrowed.
- How much was released.
- When collection started.
- What harassment happened.
- Who else was contacted.
- What rules you believe were violated.
Upload evidence:
- Screenshots.
- Call logs.
- Loan documents.
- Proof of messages to contacts.
- Links to public posts.
- Your valid ID, if required by the form.
Keep the ticket number.
Check the portal for updates and reply promptly if the SEC requests clarification.

What to write in the SEC complaint

Use plain language. You do not need to sound like a lawyer. A strong complaint is specific.

Example:

I am filing a complaint against [App Name] / [Company Name] for unfair debt collection practices. On [date], its collectors sent messages threatening to post my personal information if I did not pay immediately. On [date], they contacted my sister and employer even though they are not guarantors. They disclosed my loan and called me a scammer. They also called me repeatedly after 10:00 p.m. I am attaching screenshots, call logs, and copies of messages sent to my contacts.

Then list the attachments:

Annex A: Screenshot of threat dated ___
Annex B: Message to my employer dated ___
Annex C: Call log showing calls after 10 p.m.
Annex D: Loan agreement and disclosure statement
Annex E: App details and payment instructions

Step 4: File a Complaint with the NPC for Data Privacy Violations

File with the NPC if the online lending app:

Accessed your phone contacts without proper basis.
Messaged people in your contact list.
Used your profile photo, selfie, ID, or gallery image to shame you.
Required excessive permissions.
Used your data for purposes not clearly disclosed.
Refused to delete or stop unlawful processing of your data.
Shared your loan information with people who are not guarantors.

The NPC complaint page states that a formal complaint must be filed in a specific format: download the form, print and fill it out, have it notarized, then submit it in person, by courier, or by scanned copy through the NPC complaint email. (National Privacy Commission) The NPC contact page also lists complaint contact channels, including the complaint email and phone lines. (National Privacy Commission)

Practical NPC filing steps

Download the NPC complaint form from the NPC website.
Prepare a clear statement of facts.
Identify the online lending app, company, collectors, and data involved.
Explain how your personal data was misused.
Attach evidence:
- Screenshots showing contact-list harassment.
- Messages sent to your contacts.
- App permissions requested.
- Privacy policy screenshots.
- Loan application screens.
- Photos or IDs used against you.
Have the complaint notarized.
Submit it to the NPC by the allowed method.
Keep proof of filing.

What to emphasize in an NPC complaint

Focus on personal data misuse, not just collection pressure. For example:

The app accessed your entire contact list even though only one or two references were needed.
Collectors messaged people who were never guarantors.
The app used your selfie or ID for shaming instead of identity verification.
Consent was forced, unclear, or bundled with unnecessary permissions.
The app retained or used data after the purpose was already fulfilled.

The NPC has previously acted against online lending practices involving access to contacts and debt-shaming. In one NPC report, the Commission noted that it had issued a ban on data processing against 26 online lending apps for data privacy violations, including debt-shaming, and later ordered online lending applications to stop accessing contact lists of borrowers. (National Privacy Commission)

Step 5: Report Threats, Fake Warrants, Extortion, or Cyber Harassment

File with cybercrime authorities if the collector’s conduct goes beyond unfair collection and becomes threatening, fraudulent, coercive, or criminal.

Examples:

Fake warrant of arrest.
Fake subpoena or court order.
Pretending to be police, NBI, sheriff, prosecutor, or court staff.
Threatening physical harm.
Demanding extra money to stop harassment.
Posting edited photos.
Creating fake social media accounts.
Threatening to expose private images.
Sending malicious links.
Blackmailing you or your contacts.

The 2026 DICT-NPC-SEC advisory lists these reporting channels for other forms of harassment, threats, frauds, and scams: DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group. The NBI Citizen’s Charter for computer crime complaints shows that the general public may proceed to the CyberCrime Division to file a complaint or request investigation, with initial steps such as filing a complaint sheet, preliminary interview, sworn statements, and submission of supporting documents. (National Bureau of Investigation)

Possible legal bases may include:

Revised Penal Code Article 282 on grave threats, if there are serious threats to harm a person, reputation, or property.
Article 283 on light threats, depending on the nature of the threat.
Article 286 on grave coercions, if force, violence, or intimidation is used to compel you to do something against your will.
Article 287 on unjust vexation or light coercions, depending on the facts.
Articles 353 and 355 on libel, if defamatory statements are published.
Republic Act No. 10175, the Cybercrime Prevention Act, if the offense is committed through information and communications technology.
Civil Code Articles 19, 20, 21, and 26, if the conduct violates rights, causes damage, or humiliates a person contrary to law, morals, good customs, public order, or public policy.

For online defamation, the Supreme Court in Disini v. Secretary of Justice recognized that online libel under the Cybercrime Prevention Act is tied to libel under the Revised Penal Code, while also striking down certain unconstitutional provisions of the Cybercrime law. (Lawphil)

Step 6: Secure Your Phone and Warn Your Contacts

Once you have preserved evidence, reduce the damage.

Do these immediately:

Revoke app permissions
- Contacts.
- Camera.
- Microphone.
- Photos.
- Location.
- SMS.
- Files.
Change passwords
- Email.
- E-wallets.
- Banking apps.
- Social media.
- Cloud storage.
Turn on two-factor authentication
- Use an authenticator app or secure number.
Warn your contacts
- Tell them not to reply, pay, click links, or give information.
- Ask them to screenshot any messages.
- Tell them they are not liable unless they actually agreed to be guarantors or co-makers.
Report and request takedown
- Report abusive social media posts.
- Preserve links and screenshots before takedown.
- If your ID or sensitive data was posted, state that it contains private personal information.
Avoid emotional replies
- Do not threaten back.
- Do not admit to facts you do not understand.
- Do not send more IDs, selfies, or passwords.
- Do not pay unofficial “settlement fees” to random collectors without written confirmation from the lender.

Required Documents and Evidence Checklist

Document or evidence	SEC	NPC	NBI/PNP/DICT
Valid ID	Helpful	Usually required	Usually required
Complaint narrative or affidavit	Helpful	Required for formal complaint	Usually required
Screenshots of threats/messages	Required in practice	Required in practice	Required in practice
Call logs	Helpful	Helpful	Helpful
Messages sent to relatives/employer	Very important	Very important	Very important
Loan agreement/disclosure statement	Very important	Helpful	Helpful
App privacy policy and permissions	Helpful	Very important	Helpful
Social media links/posts	Very important	Very important if personal data is exposed	Very important
Names/numbers/usernames of collectors	Very important	Helpful	Very important
Proof of payment or payment demands	Helpful	Helpful	Helpful
Witness screenshots/statements	Very helpful	Very helpful	Very helpful

If you are overseas, you can still prepare and submit digital evidence. If an agency later requires a sworn statement or notarized document, ask whether it will accept a notarized affidavit executed abroad, a consular acknowledgment, or a document authenticated under the applicable apostille or consular process. This matters for OFWs, foreign spouses, and foreigners who borrowed from a Philippine-facing app while outside the Philippines.

Common Mistakes That Weaken Complaints

Deleting the app before saving evidence

Uninstalling the app may remove messages, loan details, account screens, or permission history. Save what you can first.

Sending only one screenshot

A single screenshot may not show the pattern. Regulators need context: dates, repeated calls, multiple contacts, public posts, and the link between the collector and the app.

Filing only with the wrong agency

If the issue is abusive debt collection, file with the SEC. If the issue is contact harvesting or use of photos, file with the NPC. If there are threats, extortion, fake warrants, or impersonation, report to cybercrime authorities. Many cases require filing with more than one office because the same conduct can violate different laws.

Ignoring the legal company name

The app name may not be the legal entity. Always check the loan contract, disclosure statement, privacy policy, app store listing, and payment account.

Paying a collector without proof

If you decide to pay, pay only through official channels and keep receipts. Ask for a written statement of account and confirmation that the payment will be applied to your loan. Avoid sending money to personal e-wallet accounts unless the lender has clearly authorized that channel.

Believing fake legal threats

Collectors often use words like “cybercrime case,” “estafa,” “warrant,” “subpoena,” “sheriff,” or “blacklist” to scare borrowers. A real warrant or court order does not come from a random collector through a threatening text message. It comes through lawful procedures.

What Happens After You File?

SEC complaint

The SEC ticketing system generates a ticket and allows status tracking. Your complaint may be assigned to the responsible department. The SEC may ask for more documents, require the company to comment, evaluate whether collection practices violated SEC rules, or impose administrative sanctions where warranted. The SEC’s MC 18 penalties include fines for first and second offenses and, for serious or repeated violations, possible higher fines, suspension of lending or financing activities, or revocation of authority, depending on the circumstances.

NPC complaint

The NPC may evaluate whether the complaint is sufficient in form and substance, require additional submissions, order conferences or hearings, or take enforcement action depending on the case. Because the NPC formal complaint requires a specific format and notarization, incomplete complaints can be delayed or returned for correction. (National Privacy Commission)

NBI or PNP complaint

Cybercrime complaints usually begin with intake, interview, sworn statements, and submission of digital evidence. The NBI Citizen’s Charter shows that complainants may file a complaint sheet, undergo preliminary interview, submit sworn statements, and provide supporting documents for investigation. (National Bureau of Investigation) If the case supports criminal action, investigators may coordinate further evidence gathering and referral for prosecution.

Practical timelines

Timelines vary widely. Simple intake may be quick, but investigation, agency evaluation, company response, and enforcement can take weeks or months. Delays usually happen because:

screenshots lack dates or sender details;
the app’s legal operator is unclear;
the borrower cannot show the connection between the collector and the company;
the complaint was filed with the wrong agency;
the agency asks for clearer copies or notarized statements;
the harassment involves foreign-hosted apps, prepaid SIMs, fake accounts, or multiple payment channels.

If the Lending App Is Not SEC-Registered

File anyway. An unregistered lender may create an additional violation.

Under RA 9474, no lending company may conduct business without SEC authority to operate, and persons engaging in lending-company business without valid authority may face penalties. (Supreme Court E-Library) For financing companies, RA 8556 also prohibits holding oneself out as a financing company without authority. (Bureau of the Treasury)

In your complaint, say:

I could not verify that this app has a valid SEC registration or Certificate of Authority. I request verification of its authority to operate and investigation of its collection practices.

Attach whatever details you have: app link, screenshots, loan contract, payment account, sender numbers, and company names used.

If the App Contacted Your Employer or Relatives

This is one of the strongest signs of an unfair collection and privacy issue, especially if the person contacted was not a guarantor or co-maker.

Ask the contacted person for:

screenshot of the message;
date and time received;
number or account used by the collector;
statement that they did not consent to be a guarantor;
statement that they were not involved in your loan.

The 2026 advisory says contacting persons on the borrower’s contact list other than named guarantors is prohibited, and that a guarantor must have expressly consented to assume responsibility for the loan in case of default.

If the Collector Posted You on Facebook, TikTok, or Group Chats

Take screenshots immediately. Capture:

the full post;
comments;
profile or page name;
URL;
date and time;
number of views, shares, or group members if visible;
any photo, ID, address, employer, or loan detail exposed.

Then file with:

SEC, for unfair collection and public shaming;
NPC, for unauthorized disclosure of personal data;
NBI/PNP, if the post contains threats, fake accusations, cyberlibel, extortion, or identity misuse;
the platform itself, for takedown.

Do not rely only on platform reporting. A takedown may remove the post, but the government complaint still needs preserved evidence.

If You Actually Owe the Loan

You can still complain. A valid debt does not legalize harassment.

A lawful lender’s remedy is to demand payment properly and, if necessary, file a civil collection case. For smaller money claims, loan obligations may fall under small claims procedures in first-level courts when within the applicable threshold, and the Supreme Court has rules for expedited procedures in first-level courts. (Supreme Court of the Philippines) But the lender cannot invent a warrant, threaten your family, or shame you online to shortcut legal process.

If you are willing to settle:

ask for a written statement of account;
verify the correct corporate payee;
pay only through official channels;
keep receipts;
request written confirmation that the account is fully paid or updated;
do not agree to new fees that were not in the loan documents.

Frequently Asked Questions

Can I file a complaint even if I still have an unpaid loan?

Yes. Your unpaid balance and the collector’s illegal behavior are separate issues. A lender may pursue lawful collection, but it cannot threaten, shame, deceive, or misuse your personal data.

Which agency should I file with first, SEC or NPC?

File with the SEC if the main issue is abusive collection. File with the NPC if the main issue is misuse of contacts, photos, IDs, app permissions, or personal data. If both happened, file with both.

Can an online lending app contact my contacts?

Generally, it should not contact people in your contact list for collection unless they are proper guarantors. The 2026 DICT-NPC-SEC advisory states that contacting persons in the borrower’s contact list other than named guarantors is prohibited, and a guarantor must have expressly consented to be responsible for the loan.

Can I be arrested for not paying an online loan?

Not for ordinary non-payment of debt. The Constitution says no person shall be imprisoned for debt. (Supreme Court E-Library) However, separate criminal acts such as fraud, falsification, identity theft, or bouncing checks may create separate issues if the facts support them.

What if the collector says they are from the police, NBI, or court?

Ask for the official document and verify with the agency directly. Do not send money or personal data because of a threatening text. Fake warrants, fake subpoenas, and impersonation should be reported to cybercrime authorities.

Do I need a lawyer to file with the SEC or NPC?

For many administrative complaints, borrowers file on their own using screenshots, a written narrative, IDs, and supporting documents. For complex cases involving criminal threats, public shaming, large amounts, or multiple victims, legal assistance can help organize evidence and prepare affidavits.

What if I am an OFW or outside the Philippines?

You can still preserve evidence, file online where the agency allows online submission, and coordinate by email or portal. If a notarized affidavit is required, ask the agency what form of notarization, consular acknowledgment, or authentication it will accept for documents executed abroad.

What if the app is no longer in Google Play or changed its name?

File using all old and new names, screenshots, payment channels, phone numbers, and messages. Apps may rebrand, disappear, or operate under several names, but evidence such as payment accounts, privacy policies, and message trails can help regulators trace them.

Can I ask the SEC or NPC to cancel my debt?

A complaint against harassment does not automatically cancel a valid loan. The SEC or NPC focuses on regulatory violations, unfair collection, and data privacy issues. Disputes over the amount, illegal charges, hidden fees, or validity of the loan should be explained clearly and supported by loan documents and payment records.

What if the harassment continues after I file?

Keep documenting every new message, call, post, or contact with your relatives or employer. Add the new evidence to your existing SEC ticket or NPC complaint when possible. Continued harassment after a complaint can strengthen the pattern of abusive conduct.

Key Takeaways

Online lending apps may collect debts, but they cannot threaten, shame, deceive, or harass borrowers.
File with the SEC for unfair debt collection by lending or financing companies and online lending platforms.
File with the NPC if the app misused your contacts, photos, ID, app permissions, or other personal data.
Report threats, fake warrants, extortion, impersonation, fraud, or cyber harassment to DICT, NBI, or PNP Anti-Cybercrime Group.
Preserve screenshots, call logs, loan documents, app details, and messages sent to your contacts before deleting or blocking anything.
Unpaid debt alone is not a basis for imprisonment in the Philippines.
A valid loan does not give a collector the right to humiliate you, contact your employer, or expose your private information.