Quick answer

You may complain about an online lending app’s harassment even if the loan is valid and unpaid. A lender may make lawful collection demands or pursue a court case, but it may not use threats, insults, deception, public shaming, unauthorized disclosure of personal data, or abusive contact with your family, friends, co-workers, or phone contacts.

For most online lending apps, take these steps:

Preserve the messages, call logs, posts, loan records, and app details.
Send a written complaint and demand to the lending company.
Report unfair collection practices to the Securities and Exchange Commission (SEC).
Complain to the National Privacy Commission (NPC) if the app accessed, used, or disclosed personal data improperly.
Report threats, extortion, impersonation, or other possible crimes promptly to the police or National Bureau of Investigation (NBI).

These remedies serve different purposes. Filing with one agency does not necessarily replace filing with another.

What conduct may be unlawful?

Collection activity does not become lawful simply because money is owed. Depending on the facts, prohibited or actionable conduct may include:

Threatening violence, arrest, imprisonment, physical harm, or damage to property or reputation;
Using obscene, insulting, profane, or humiliating language;
Threatening an action the collector cannot legally take;
Falsely claiming to be a police officer, lawyer, court employee, government official, or authorized representative;
Creating fake warrants, court notices, barangay documents, or legal-demand letters;
Posting the borrower’s name, photograph, identification document, debt, or other personal information publicly;
Sending debt-shaming messages to relatives, friends, employers, co-workers, or other persons who are not responsible for the debt;
Accessing or using the borrower’s phone contacts for collection beyond what the law permits;
Repeatedly contacting character references to pressure them to pay;
Contacting people merely because their details appear in the borrower’s phone;
Making calls or sending messages at unreasonable or inconvenient hours, subject to lawful exceptions;
Continuing abusive conduct through a third-party collection agency.

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by lending and financing companies. The company cannot automatically avoid responsibility by outsourcing collection to an agent.

The Financial Products and Services Consumer Protection Act also prohibits financial service providers from employing abusive collection or debt-recovery practices and requires them to respect consumer privacy and protect client data.

Contacting a borrower is not automatically harassment

A creditor generally may:

Remind a borrower that payment is due;
State the amount it claims is payable;
Ask for payment or propose a payment arrangement;
Contact a guarantor or co-maker within the scope of that person’s legal obligation;
Send a formal demand letter; or
File a proper civil action to collect a legally enforceable debt.

Whether repeated communication amounts to harassment depends on its frequency, timing, language, recipients, purpose, and surrounding circumstances. A firm but accurate payment demand sent directly to the borrower is different from threats, insults, impersonation, or mass messaging to unrelated contacts.

The debt and the harassment are separate issues

A complaint against abusive collection does not automatically cancel the loan. Likewise, an unpaid debt does not give the lender permission to violate collection, privacy, or criminal laws.

Continue to examine:

Whether you actually received the loan proceeds;
The correct principal balance;
Payments already made;
Interest, penalties, processing fees, and other charges;
The disclosure statement and loan agreement; and
Whether the company is authorized to operate.

Do not pay through a new or unfamiliar personal account merely because a collector threatens you. Confirm the official payment channel directly with the company, obtain a receipt, and keep proof of every payment.

Ordinary nonpayment of a debt is generally a civil matter. However, allegations involving fraud, dishonored checks, or other independent acts require separate legal analysis. Do not ignore an authentic subpoena, summons, prosecutor’s notice, or court document.

Step 1: Protect yourself and preserve the evidence

Do this before blocking numbers, uninstalling the app, deleting conversations, or changing devices.

Save:

Full screenshots showing the message, sender, date, and time;
The entire conversation, not only the most offensive line;
Call logs, voicemail, and recordings lawfully obtained;
URLs and screenshots of social-media posts or group messages;
Messages received by relatives, friends, references, employers, or co-workers;
Written statements or affidavits from people who were contacted;
The app’s exact name, icon, developer, download-page URL, and package identifier if visible;
The lending company’s corporate name from the loan agreement, disclosure statement, privacy notice, or app terms;
Loan applications, contracts, disclosure statements, receipts, repayment histories, and account statements;
Proof of the amount actually received;
The permissions the app requested or used;
Copies of advertisements and representations made before the loan;
Your written complaint to the company and proof it was received;
The company’s response, ticket number, or acknowledgment; and
Any police blotter, medical record, employer notice, or other evidence of resulting harm.

Export chats when possible. Keep the original files and make a backup. Avoid cropping out phone numbers, usernames, timestamps, URLs, or other details that help authenticate the evidence.

Ask affected contacts not to delete the messages they received. Their own screenshots are often stronger than screenshots merely forwarded to you.

Step 2: Identify the company behind the app

The app’s brand name may differ from the lender’s registered corporate name. Look for the legal entity in:

The loan agreement;
Disclosure statement;
Privacy notice;
Terms and conditions;
Payment instructions;
Email footer; or
App-store developer information.

Use the SEC’s official Check with SEC service and current lists of lending companies, financing companies, and recorded online lending platforms on the SEC website. Check both the corporate registration and the authority to operate as a lending or financing company. Corporate registration alone does not necessarily establish authority to conduct a lending business.

If you cannot identify the entity, retain every available clue: app name, website, collector numbers, email addresses, payment-wallet details, bank accounts, advertisements, and app-store links. State in the complaint what you did to identify the operator.

Step 3: Send a written complaint to the lender

Write to the company’s customer-service channel, complaints officer, data-protection officer, and any address shown in the contract or privacy notice. Use email or another method that creates proof of delivery.

Your notice should:

Identify you and the loan account sufficiently;
Describe each incident by date, time, sender, recipient, and method;
Identify any third parties contacted;
Explain what information was disclosed;
State that you object to harassment and unauthorized processing or disclosure;
Demand that the conduct stop;
Ask the company to preserve relevant call records, messages, account notes, access logs, and collection-agent instructions; -- Request the company’s findings and corrective action in writing; and
Clarify that you remain willing to communicate through a specified lawful channel about the legitimate account balance, if appropriate.

Do not include passwords, PINs, one-time passwords, or unnecessary copies of sensitive identification documents.

This written notice is particularly important for an NPC complaint. Under the NPC’s amended procedural rules, the complainant ordinarily must first inform the company in writing and give it an opportunity to act. If it takes no timely or appropriate action—or gives no response within 15 calendar days after receiving the notice—you may proceed with proof of that effort. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, no plain and adequate remedy, or patently illegal conduct. See the NPC Rules of Procedure, as amended.

Do not wait 15 days before seeking police help when there is an immediate threat or possible ongoing crime.

Step 4: File the collection complaint with the SEC

The SEC generally regulates lending and financing companies, including their online lending platforms. A complaint may cover harassment, unfair collection, unauthorized operation, misleading disclosures, excessive or unexplained charges, or related violations within the SEC’s jurisdiction.

Use the SEC’s official iMessage portal to open a ticket and select the service or department for complaints against lending or financing companies. Because the SEC may change filing channels and documentary requirements, follow the instructions displayed in the portal at the time of submission.

Prepare:

Your full name and reliable contact details;
The respondent’s exact corporate and app names;
A short chronological statement of facts;
The loan account or transaction details;
The specific conduct complained of;
The names or identifiers of collectors, if known;
Copies of the contract, disclosure statement, and payment records;
Screenshots, call logs, posts, recordings, and witness material;
Your prior written complaint to the company and its response, if any;
A copy of a valid ID if required by the current form; and
The remedy requested, such as cessation of harassment, investigation, account correction, or appropriate regulatory action.

Use separate, clearly labeled files. A simple evidence index—“Annex A: Loan agreement,” “Annex B: Messages to borrower,” and so on—helps the reviewer follow the complaint.

If the app appears unregistered or unauthorized, say so and attach the search result or explain that you could not find the company or platform in the SEC’s official records.

Step 5: File with the NPC when personal data was misused

The NPC is the appropriate regulator when the complaint involves personal-data processing, such as:

Harvesting or accessing phone contacts;
Using contact information for a purpose beyond lawful loan processing;
Disclosing a debt or personal details to unrelated persons;
Publishing personal information to shame the borrower;
Using photographs or identification documents improperly;
Failing to provide adequate privacy information; or
Ignoring a valid objection or other data-subject request.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, lenders must limit loan-related processing to lawful, necessary, and proportionate purposes. A borrower may be asked for character references, but that does not authorize unrestricted access to the borrower’s contact list or harassment of references. Processing that becomes excessive, disproportionate, or part of an unfair collection practice is not justified merely because a loan exists.

NPC filing requirements

Use the NPC’s current Complaint-Affidavit template, which took effect on July 1, 2025. Download the current form and check current instructions through the NPC’s complaint page or forms page.

A formal complaint generally must:

Be written, signed, and verified;
Identify the complainant and respondent, or provide facts that may lead to the respondent’s identity;
State the material facts and alleged privacy violation;
Include the relief requested;
Attach communications showing that the respondent was first notified;
Include documentary evidence and witness affidavits, when available;
Include the required certification against forum shopping; and
Be notarized or otherwise executed as required by the current form and rules.

The complaint may be filed personally, by registered mail, by courier, or by electronic mail when authorized by the NPC. The NPC currently directs complaints to complaints@privacy.gov.ph, but verify the address and submission instructions on its website before sending. Electronic submissions must comply with the NPC’s file, signature, readability, and formatting requirements.

The rules provide for filing fees, subject to exemptions or waiver for government complainants, qualified indigent complainants, or good cause as determined by the NPC. Obtain the assessment and use only the NPC’s official payment instructions.

The NPC’s current contact information and office notices are published at privacy.gov.ph. Keep the acknowledgment, payment record, and case or reference number.

Step 6: Use the BSP process only for a BSP-supervised provider

Some digital credit products are offered by banks, digital banks, electronic-money issuers, or other institutions supervised by the Bangko Sentral ng Pilipinas. If the respondent is a BSP-supervised financial institution, first complain through that institution’s Financial Consumer Protection Assistance Mechanism.

If the issue remains unresolved, escalate it through the BSP’s Consumer Assistance Mechanism:

Use the BSP Online Buddy;
Submit the official Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph; or
Use the other official mail, telephone, or walk-in channels listed by the BSP.

Attach your complaint to the institution and its response, if any. Do not send your PIN, password, one-time password, or full card credentials.

The BSP route does not ordinarily replace an SEC complaint against an SEC-regulated lending company. Identify the actual financial service provider rather than assuming the regulator from the app’s appearance.

Step 7: Report threats or other possible crimes

Go to the nearest police station or contact the NBI promptly if the conduct includes:

A credible threat of violence or physical harm;
Extortion or a demand backed by an unlawful threat;
Stalking or an attempt to locate you physically;
Impersonation of police, courts, lawyers, or government offices;
Fabricated warrants or official documents;
Hacking, account takeover, or unauthorized system access; or
Publication of defamatory material through an online platform.

If danger is immediate, call 911 or seek help from the nearest police station. Tell trusted people where you are, avoid meeting collectors alone, and do not follow links or install files sent by a threatening collector.

The Cybercrime Prevention Act designates the NBI and PNP as law-enforcement authorities for cybercrime. The NBI accepts an online complaint and provides investigative assistance through its Cybercrime Division and regional centers. Its published procedure may require a complaint form, sworn statement or affidavit, supporting documents, and examination of a relevant device.

A criminal case depends on the precise words, acts, intent, recipients, and admissible evidence. Harsh language alone does not automatically establish every criminal offense, so preserve the original material and let investigators or counsel assess the proper charge.

A practical complaint outline

Use a clear, factual chronology:

I obtained a loan through [app] on [date]. The agreement identifies the lender as [corporate name]. Beginning on [date], persons using [numbers/accounts] contacted me and/or the following third parties: [identify them]. They stated or disclosed [brief description]. Copies of the messages and call records are attached.

On [date], I notified the company through [channel], which it received on [date]. The company [did not respond/responded as follows], and the conduct [continued/stopped].

I request an investigation, an order stopping the abusive collection and unauthorized processing or disclosure, preservation of relevant records, correction of any inaccurate account information, and any other relief within the agency’s authority.

Quote only the material words necessary to show the threat, insult, falsehood, or disclosure. Do not exaggerate, guess the collector’s identity, or conceal relevant payments and communications.

Common mistakes that weaken a complaint

Naming only the app and not the company behind it;
Deleting the app or messages before preserving evidence;
Submitting cropped screenshots without dates, numbers, or usernames;
Sending only a narrative with no contract, account record, or supporting files;
Failing to show that third parties actually received the messages;
Filing an NPC complaint without first notifying the company, unless a supported exception applies;
Using an outdated NPC form;
Omitting verification, notarization, or certification against forum shopping;
Sending unclear, corrupted, password-protected, or excessively large files;
Combining incidents involving different lenders without separating the evidence;
Treating an SEC report, NPC complaint, and police report as interchangeable;
Assuming that harassment automatically extinguishes the debt;
Paying a collector’s personal account without verification; or
Ignoring authentic notices while responding only to abusive messages.

What relief may be available?

The available outcome depends on the agency, evidence, and violation.

The SEC may investigate and impose measures within its regulatory authority against a lending or financing company. The NPC may issue compliance or enforcement orders, restrict or prohibit personal-data processing, impose appropriate administrative sanctions, award indemnity in matters affecting personal data when legally supported, or recommend criminal prosecution. Police and the NBI may investigate conduct that may constitute a crime and refer the matter for prosecution.

A separate civil claim for damages may sometimes be possible under the Data Privacy Act, Civil Code, or other law. Liability and damages are not automatic; they depend on the legal cause of action, proof of injury, responsible parties, and applicable limitation periods.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

You or your family face a credible threat;
Intimate images, identification records, medical information, or other highly sensitive material were disclosed;
The collector contacted your employer or caused loss of work;
A false accusation or public post is spreading;
Money is being demanded through extortion;
You received an authentic subpoena, prosecutor’s notice, summons, or court pleading;
A deadline stated in an agency order is approaching;
Several companies or foreign operators are involved;
You need an injunction, damages, or other court relief; or
You are unsure whether a proposed settlement waives important rights.

Bring an organized timeline, the original device if relevant, printed copies of key evidence, the loan documents, and all agency acknowledgments.

Frequently asked questions

Can I complain even if I have not paid the loan?

Yes. Nonpayment does not authorize harassment or privacy violations. Your repayment obligation and the collector’s conduct are separate legal questions.

May the lender contact my family or employer?

The answer depends on why they are being contacted, what they legally agreed to, and what is disclosed. A genuine guarantor or co-maker may be contacted about that obligation. Mass messaging unrelated contacts or disclosing the debt merely to shame or pressure the borrower may violate collection and privacy rules.

Is a character reference automatically a guarantor?

No. Providing someone as a reference does not by itself make that person liable for the loan. A guaranty or similar undertaking requires a legally sufficient basis; it should not be inferred simply from appearance in a contact list or reference field.

Can collectors have me arrested for an unpaid online loan?

A collector cannot order an arrest. Arrest requires lawful authority and process. Ordinary inability or failure to pay a contractual debt is not, by itself, a basis for imprisonment. Separate fraudulent or criminal acts, if properly alleged and proved, are a different matter.

Should I uninstall the lending app?

First preserve the app name, account screens, permissions, contract, privacy notice, messages, and transaction history. You may then review and revoke unnecessary permissions through your phone settings. Uninstalling an app does not necessarily erase data the company already holds or cancel the loan.

Should I block the collectors?

After preserving evidence, blocking abusive numbers may reduce harm. Keep at least one controlled written channel available for legitimate account communications when safe. Blocking a number does not prevent the company from filing a lawful collection case.

Can my relative or friend file the privacy complaint for me?

A representative may file, but the NPC generally requires a special power of attorney. Different proof applies when a parent represents a minor or a court-appointed guardian acts for an incompetent person.

Is there a deadline for complaining?

Do not delay. Different administrative, civil, and criminal remedies have different prescriptive periods. The current NPC rules apply the statutory prescription rules governing offenses under special laws rather than a single deadline for every privacy complaint. Early filing also prevents loss of messages, logs, platform records, and witness recollection.

Can I ask the app store or social-media platform to remove content?

Yes. Report the app, account, message, or post through the platform’s official abuse, privacy, impersonation, or harassment channel. Preserve the content and URL first. A platform report is useful for immediate mitigation but does not replace a complaint to the proper Philippine agency.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rules and filing channels may change, and the proper remedy depends on the documents and facts. Official sources were checked as of September 4, 2026.