When an online lending app threatens to have you arrested, sends your debt details or photo to relatives and coworkers, or floods your phone with abusive messages, the issue is no longer simply an unpaid loan. Philippine law allows a lender to demand payment and file a proper collection case, but it does not allow intimidation, public shaming, deception, or unrestricted use of your phone contacts. Depending on what happened, you may file separate complaints with the Securities and Exchange Commission (SEC), National Privacy Commission (NPC), Bangko Sentral ng Pilipinas (BSP), or law-enforcement authorities.

What Counts as Online Lending App Harassment?

A legitimate lender may remind you that payment is overdue, explain the amount due, propose a payment arrangement, send a formal demand letter, or file a civil collection case. The lender must still use lawful and reasonable methods.

Conduct that may justify a complaint includes:

Generally legitimate collection activity	Potentially unlawful or reportable conduct
Identifying the lender and collector	Hiding the collector’s identity or pretending to be a police officer, lawyer, court employee, or government official
Giving an accurate statement of account	Inventing penalties, court cases, arrest warrants, or criminal charges
Sending a professional payment reminder	Using obscenities, insults, sexual remarks, or degrading language
Contacting an actual guarantor or co-maker	Messaging everyone in the borrower’s contact list
Sending a lawful demand letter	Threatening violence, property damage, arrest without legal process, or actions the collector cannot legally take
Filing a civil collection case	Posting the borrower’s photo, ID, debt, or personal information on social media or group chats
Offering restructuring or settlement	Repeatedly calling relatives, employers, clients, or coworkers to shame or pressure the borrower
Asking for payment through an official company channel	Ordering payment to an unverified personal e-wallet or bank account

A collector does not avoid responsibility by using a third-party collection agency, freelance collector, call center, or automated messaging system. Under SEC rules, the financing or lending company remains ultimately responsible for the collection methods used on its behalf.

Your Rights Under Philippine Law

SEC rules prohibit unfair debt collection practices

Lending companies are regulated principally under Republic Act No. 9474, or the Lending Company Regulation Act of 2007. Financing companies are governed by Republic Act No. 8556, or the Financing Company Act of 1998, as amended.

Under SEC Memorandum Circular No. 18, Series of 2019, lending companies, financing companies, and the collection service providers they hire must refrain from unfair collection practices. Prohibited conduct includes:

Threats of violence or other criminal means that may harm a person, reputation, or property
Threatening an action that cannot legally be taken
Obscene, insulting, or profane language amounting to abuse
Publishing or disclosing borrowers’ names and personal information to shame them
Communicating false loan information, including concealing that a debt is disputed
Using deception or false representations to collect a debt or obtain information
Contacting people in the borrower’s phone list other than genuine guarantors or co-makers
Failing to disclose the collector’s true identity

A commonly misunderstood rule concerns collection hours. Contact before 6:00 a.m. or after 10:00 p.m. is treated as unreasonable or inconvenient, but the circular contains exceptions where the account has been past due for more than 15 days or the borrower expressly agreed that those hours are the only reasonable or convenient times. That timing exception does not authorize threats, insults, deception, public shaming, or contacting unrelated people.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765 of 2022, also recognizes financial consumers’ rights to fair treatment, transparent disclosure, protection of their assets and personal information, and timely handling of complaints. (Lawphil)

An app cannot use your contacts however it wants

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal data processing to be transparent, based on a lawful purpose, and proportionate to that purpose.

The NPC’s loan-related privacy rules, particularly NPC Circular No. 2020-01 as amended by NPC Circular No. 2022-02, prohibit unrestrained processing of a borrower’s contact list. An app may not harvest the entire contact list and then use it to harass people, advertise loans, or collect from persons who never guaranteed the debt.

Limited access may be permitted for a proportionate purpose, such as allowing the borrower to select a character reference through a separate interface. However:

A character reference is ordinarily contacted to help verify the borrower’s identity or application information.
A character reference does not automatically become responsible for the loan.
A guarantor must separately and expressly agree to guarantee the debt. Article 2055 of the Civil Code of the Philippines states that a guaranty is not presumed and must be express.
Contacting references for debt collection, marketing, cross-selling, or public shaming is prohibited.
Photos obtained for identification or payment verification cannot later be used to embarrass the borrower.

NPC enforcement decisions have treated the collection and storage of an applicant’s entire contact list as excessive where the information was not genuinely necessary for the loan transaction.

You cannot be jailed merely for unpaid debt

Article III, Section 20 of the 1987 Philippine Constitution provides that no person shall be imprisoned for debt.

This means an unpaid online loan, by itself, does not authorize a collector to have you arrested. A lender may file a civil collection case, and a genuine court summons must not be ignored. Separate criminal liability may arise only when there are facts supporting an actual offense, such as fraud committed when obtaining the loan. A collector’s text saying “the police will arrest you today” is not a warrant, subpoena, or court order. (Lawphil)

Serious harassment may also lead to criminal or civil liability

Depending on the exact words, conduct, and evidence, harassment may potentially involve:

Grave threats under Article 282 of the Revised Penal Code
Grave coercion under Article 286
Libel under Articles 353 and 355
Cyberlibel when defamatory publication is made through a computer system
Unauthorized access, identity misuse, or other offenses under the Cybercrime Prevention Act of 2012, Republic Act No. 10175
Unauthorized processing, malicious disclosure, or unauthorized disclosure under the Data Privacy Act

Not every rude message automatically constitutes a crime. Investigators and prosecutors consider the precise statement, context, intended victim, publication to third persons, sender identity, and surrounding evidence.

Articles 19, 20, 21, and 26 of the Civil Code may also support a separate civil claim for damages when someone abuses a right, violates the law, intentionally causes injury contrary to morals or public policy, or unjustifiably interferes with another person’s dignity, privacy, family life, or peace of mind. (Lawphil)

Preserve Your Evidence Before Deleting the App

Do not immediately uninstall the lending app, reset your phone, or delete the messages. Preserve the evidence first.

Capture the complete messages. Take screenshots showing the sender’s number or profile, date, time, app name, and full conversation. Avoid keeping only cropped portions that remove context.
Make a screen recording. Scroll slowly through the conversation, collector profile, call history, app permissions, account page, loan balance, and payment instructions.
Save original electronic files. Export chats where the platform permits it. Back up the original screenshots and recordings to another device or secure cloud storage.
Document the app itself. Save the app-store page, developer name, download link, privacy policy, terms and conditions, permissions requested, and any displayed company or SEC registration details.
Preserve the loan documents. Keep the loan agreement, disclosure statement, repayment schedule, disbursement proof, receipts, statement of account, and messages disputing the amount.
Collect evidence from third parties. Ask relatives, friends, employers, or coworkers who were contacted to save their own original screenshots, call logs, voice messages, and sender details. A short signed affidavit explaining what they received may later be useful.
Create an incident log. Record each event while your memory is fresh.

Date and time	Number or account used	What happened	Person contacted	Evidence filename
12 June, 8:15 a.m.	09XX-XXX-XXXX	Threatened arrest and sent borrower’s ID	Borrower	Screenshot-01
12 June, 9:40 a.m.	Messenger profile name	Disclosed loan to employer	HR manager	Employer-Screenshot-01

Secure your accounts. After preserving evidence, revoke unnecessary Contacts, SMS, Camera, Storage, and Location permissions. Change important passwords and PINs, enable two-factor authentication, and warn contacts not to open suspicious links.
Be careful about recording calls. Save voicemail or recordings already lawfully available. Secretly recording a private live conversation can create issues under Republic Act No. 4200, the Anti-Wiretapping Act. Written notes made immediately after a call are safer than making an unauthorized covert recording. (Lawphil)

Identify the Company Behind the Lending App

The name shown on the app icon is often only a brand. Your complaint is stronger when it identifies the legal company operating the platform.

Check the following:

The lender’s legal name in the loan agreement and disclosure statement
The company named in the app’s privacy policy
The app-store developer or publisher
The name appearing on the disbursement or payment record
The recipient of previous payments
Any collection agency identified in messages
The SEC registration number and Certificate of Authority number, if displayed

Search the SEC’s list of recorded online lending platforms and its current lists of lending and financing companies.

A company’s basic SEC incorporation does not automatically authorize it to operate a lending business. Under RA 9474, a lending company must have a valid SEC Certificate of Authority. The online platform should also be properly recorded with the SEC. (Lawphil)

When the company cannot be identified, do not abandon the complaint. Provide every available identifier:

App and website names
Store or APK download link
Developer name
Phone numbers and messaging profiles
Bank and e-wallet account names
Email addresses
Privacy-policy details
Screenshots of advertisements
Names used by collectors

A payment made through GCash, Maya, or a bank does not necessarily mean the lender itself is regulated by the BSP. The payment service may simply be a collection channel.

Which Agency Should Receive the Complaint?

One incident can fall under more than one agency’s jurisdiction.

Agency	File here when the main issue involves
SEC	Abusive collection by a lending or financing company, threats of unlawful action, hidden collector identity, third-party harassment, false loan information, unregistered lending, or an unauthorized online platform
NPC	Contact-list harvesting, public disclosure of the debt, misuse of photos or IDs, unauthorized messages to references, excessive app permissions, or other misuse of personal information
BSP	A bank, digital bank, BSP-supervised non-bank institution, or other BSP-regulated financial service provider
NBI or PNP	Credible threats, coercion, identity theft, account hacking, fake warrants, defamatory online posts, or conduct that may constitute a criminal offense
City or provincial prosecutor	A criminal complaint supported by a sworn complaint-affidavit and evidence, often following police or NBI investigation
App store or social-media platform	Removal of the app, post, account, or harmful content; this is supplemental and does not replace a government complaint

Administrative complaints to the SEC or NPC do not require prior barangay conciliation. Barangay proceedings are also usually impractical where the collector is anonymous, the respondent is a corporation, or the parties do not reside in the same city or municipality.

How to File a Complaint With the SEC

Beginning 1 April 2026, SEC complaints must be filed through the SEC’s centralized iMessage system. (Facebook)

Go to the SEC iMessage portal and select Open a New Ticket.
Agree to the privacy notice and sign in through an eSECURE account. Create and verify an eSECURE account first if you do not yet have one.
In the service field, choose:

Financing and Lending Companies Department → Legal and Enforcement Division → Complaints on Financing and Lending Companies
Identify both the app and the legal entity, if known. Include the collection agency and individual collector when identifiable.
Write a chronological account containing:
- Loan date and amount
- Due date and amount demanded
- App and company names
- Exact dates of harassment
- Numbers or accounts used
- Names of third persons contacted
- Specific threats, insults, deception, or disclosures
- Whether the debt or amount was disputed
- Steps already taken with the lender
Upload organized evidence. A useful file structure is:
- 01-Complaint-Narrative.pdf
- 02-Loan-Agreement.pdf
- 03-Message-Screenshots.pdf
- 04-Third-Party-Messages.pdf
- 05-App-and-Company-Details.pdf
- 06-Payment-and-Account-Records.pdf
State the action requested. Appropriate requests may include:
- Investigation of unfair collection practices
- Verification of the company’s Certificate of Authority
- Verification that the platform is properly recorded
- An order to stop third-party harassment
- Identification of the responsible collection agency
- Correction of false account information
- Preservation of collection and communication records
- Appropriate administrative sanctions
Save the electronic ticket number and monitor the conversation thread. The SEC may ask for a clearer copy, signed statement, additional evidence, or a verified pleading under the 2026 SEC Rules of Procedure. Comply within the stated deadline.

The iMessage guide explains that the system creates a unique ticket, routes it to the responsible department, permits follow-up uploads, and allows status tracking. Even when a ticket appears under a closed category, check the thread because it may contain an instruction for compliance or payment rather than a final resolution. (Securities and Exchange Commission)

How to File a Data Privacy Complaint With the NPC

Use the NPC route when an app or collector accessed, used, stored, or disclosed personal data improperly.

1. Notify the company in writing first

NPC rules generally require the complainant to first inform the lender, app operator, collection agency, or other responsible entity of the privacy violation in writing and allow it to act.

Send the notice to:

Customer support
The company’s Data Protection Officer or privacy email
The collection agency, when known
Any formal complaint channel shown in the app

Keep proof of delivery, such as an email acknowledgment, support-ticket number, courier receipt, or screenshot showing successful transmission.

The NPC may generally proceed when the company takes no timely and appropriate action or gives no response within 15 calendar days from receipt. The NPC may waive this requirement for good cause, a serious violation, grave or irreparable harm, lack of an adequate remedy, or patently illegal conduct.

2. Download the current Complaint-Affidavit

Use the NPC’s Complaint-Affidavit form effective 1 March 2026, not an old form obtained from an unofficial website.

The form asks for:

Complainant and respondent details
Personal information processed
Steps taken to notify the respondent
Chronological facts
Legal or privacy violations alleged
Supporting evidence
Relief requested
Other cases involving the same facts
Verification and certification against forum shopping

Incomplete complaints may be dismissed outright. The current form specifically instructs complainants to attach supporting evidence and a valid government-issued ID.

3. Identify the proper respondent

Name the legal company operating the app whenever possible. Also identify:

The app brand
Collection agency
Data Protection Officer
Responsible officers or employees, if their participation is supported by evidence

When the legal identity is unknown, explain the circumstances that may help the NPC identify it, such as phone numbers, payment accounts, privacy-policy details, and developer information.

4. Explain the privacy violation clearly

State what personal information was involved and how it was misused. Examples include:

Full phone contact list
Photos, selfies, or government IDs
Loan balance and payment status
Home or work address
Employer information
Messages or call records
Device identifiers
Character-reference details

Then explain who received the information, when it was disclosed, and what harm followed.

5. Attach proof of prior written notice

Include:

Your complaint to the lender or app
Proof that it was received
The company’s response, if any
Proof that 15 calendar days passed without an adequate response, unless requesting a waiver

6. Sign and notarize the complaint

The complaint must be verified—meaning you swear that its factual allegations are true based on your personal knowledge or authentic records. It also includes a certification against forum shopping.

Truthfully disclose related SEC, BSP, police, prosecutor, court, or other NPC proceedings. Filing with more than one agency is not automatically prohibited because the agencies have different functions, but related cases must not be concealed.

7. Pay the applicable filing fee

The NPC’s published schedule lists:

₱500 complaint filing fee
Legal research fee of 1% of the filing fee, but not less than ₱10
Additional fees when the complaint includes a claim for damages
Possible fee exemption for qualified indigent litigants who submit the required proof

Confirm the current assessment and payment instructions through the NPC before paying. Keep the official receipt or electronic proof of payment.

8. Submit the complaint

Follow the current instructions on the NPC formal complaint filing page. The NPC presently permits submission in person, by courier, or by scanning the completed and notarized documents and emailing them to complaints@privacy.gov.ph.

Keep the notarized original even when filing electronically. Use legible PDFs, label each attachment, and retain the sent email with its transmission details. (National Privacy Commission)

9. Filing from abroad

An authorized representative may file for a data subject using a Special Power of Attorney.

For a non-resident Filipino who has no Philippine representative or cannot appoint one, the NPC rules expressly require the complaint to be notarized by a Philippine embassy or consulate, or accompanied by an apostille certificate from the country of origin. Documents signed abroad for a representative may likewise require apostille or consular authentication, depending on the country and the NPC’s instructions.

10. Monitor the case

Under the NPC Rules of Procedure:

The complaint is generally assigned to an investigating officer within five calendar days of receipt.
Within 30 calendar days from receipt, the investigating officer may give the complaint due course or dismiss it without prejudice for procedural or jurisdictional defects.
These are initial processing benchmarks, not deadlines for a final decision.
A contested case involving comments, conferences, mediation, evidence, and a Commission decision may take several months or longer.

Respond promptly to all orders and requests for additional documents.

When to Report the Collector to the NBI or PNP

Report the matter promptly when the messages involve:

A credible threat of physical harm
Threats against children or family members
Demands for money accompanied by threats unrelated to lawful collection
Fake arrest warrants, subpoenas, court orders, police notices, or government logos
Hacking or unauthorized access to accounts
Identity theft or use of an ID to create another account
Defamatory social-media posts or mass messages
Persistent stalking or attempts to locate the borrower physically

For immediate danger, contact emergency authorities rather than waiting for an administrative complaint to be processed.

For a formal report:

Go to the nearest PNP station, appropriate anti-cybercrime unit, or NBI office.
Bring a valid ID, the phone containing the original evidence, printed copies, backup files, and a chronological incident summary.
Execute a sworn complaint-affidavit describing the exact threats and identifying the sender as far as possible.
Bring affidavits or contact details of relatives, employers, or other witnesses.
Obtain the blotter, complaint, or reference number.
Preserve the device and original files in case investigators request forensic examination.
Provide SEC or NPC ticket numbers when related complaints have already been filed.

A police blotter records the incident but is not always the same as a complete criminal complaint. Further affidavits, identification work, subpoenas to platforms or telecommunications companies, and referral to a city or provincial prosecutor may be necessary.

The NBI’s official complaint information explains that complaints are generally made under oath. Initial email or online reporting may help route the concern, but investigators may still require personal appearance and a sworn statement. The Department of Justice also maintains an official cybercrime reporting page. (National Bureau of Investigation)

When the BSP Is the Proper Regulator

Use the BSP consumer-assistance process when the lender is a bank, digital bank, or another BSP-supervised financial service provider.

The normal sequence is:

File first with the provider’s Financial Consumer Protection Assistance Mechanism, usually its customer-service or complaints unit.
Keep the complaint reference number and written response.
If unresolved or unsatisfactory, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or BOB.
Attach the original complaint, provider’s response, transaction records, and harassment evidence.

An SEC-regulated lending company ordinarily belongs in the SEC process, even when it receives payment through a bank or e-wallet. (Bureau of Small Enterprises)

Sample Written Notice to the Lender or App

Subject: Formal complaint regarding unlawful collection and misuse of personal data

I am the borrower/account holder for the loan under [app name and account number].

On [dates], your employees, agents, or collection service providers committed the following acts: [briefly list threats, abusive messages, disclosure to third persons, contact-list use, or other conduct].

The persons contacted include [names or relationship], who are not guarantors or co-makers of the loan. Copies of the relevant messages and call records are preserved.

I demand that your company:

Stop threatening, abusive, deceptive, and third-party collection communications;

Stop processing or disclosing my personal data for unlawful or excessive purposes;

Remove the contact information of persons who are not guarantors or co-makers;

Identify the legal lender, collection agency, and responsible collector;

Preserve all account, access, contact-list, communication, and collection records;

Provide an accurate statement of account and official payment channels; and

Provide your written action on this complaint within 15 calendar days from receipt.

This notice does not admit any amount that I have previously disputed. All further communications should be professional, accurate, and sent directly to me through [email or preferred channel].

Send the notice through a traceable channel and keep proof of receipt.

Documents, Fees, and Expected Timelines

Process	Main documents	Formality or fee	Practical timeline
SEC	Narrative, ID, loan documents, screenshots, company and app details, third-party evidence	File through iMessage; SEC may later require a verified pleading or assessed filing requirements	Ticket generated electronically; evaluation or investigation may take weeks or months
NPC	Current Complaint-Affidavit, ID, prior written notice, proof of receipt, evidence, respondent details, related-case disclosure	Notarization; ₱500 filing fee plus legal research fee and possible damages-related fees	Five-day assignment and 30-day initial screening benchmarks; full case may take months or longer
NBI or PNP	Sworn complaint-affidavit, ID, original device and files, printouts, witness details	Reporting a crime ordinarily does not require an agency filing fee, although notarization and document costs may arise	Urgent threats can be reported immediately; identification and investigation may take weeks or months
BSP	Prior complaint to provider, provider’s response, transaction records, evidence	Internal complaint first, then BSP escalation	Depends on provider response and complexity
App store or platform	App link, account or post URL, screenshots, explanation of violation	Usually an online report	Removal time varies and does not determine legal liability

Common bottlenecks include unidentified prepaid numbers, fake collector names, foreign-hosted platforms, deleted accounts, incomplete screenshots, and failure to identify the legal company behind the app.

Common Mistakes That Weaken a Complaint

Deleting the app before preserving evidence

Uninstalling may remove account screens, permission records, privacy-policy details, and message history. Back up everything first.

Naming only the app brand

Regulators need the legal lender or operator whenever possible. Include both the brand and company, as well as the collection agency.

Submitting heavily cropped screenshots

A screenshot without the number, date, time, or surrounding conversation is easier to challenge. Preserve the original and submit a readable copy.

Failing to notify the company before filing with the NPC

Unless a waiver is justified, missing proof of prior written notice and the 15-day waiting period can result in dismissal without prejudice.

Assuming harassment cancels the loan

An unlawful collection method does not automatically erase a valid debt. Continue requesting an accurate statement of account and communicate about repayment separately from the harassment complaint.

Paying an unverified personal account

Do not send money solely because a collector gives a personal GCash, Maya, or bank account. Verify the channel with the lender’s official customer service and obtain a receipt identifying the loan account credited.

Retaliating against collectors

Do not threaten, dox, or publish the collector’s personal information. Retaliation can create a separate dispute and distract from the original complaint.

Secretly recording every call

Philippine anti-wiretapping rules are strict. Preserve lawful recordings such as voicemail and write immediate notes instead of assuming that a secret recording is permitted.

Ignoring a genuine court summons

A threatening text is not a summons, but an authentic summons served by a court requires attention. Verify the case directly with the named court rather than relying on the collector’s telephone number or link.

Reporting only to the app store

App-store removal may prevent further downloads but does not replace SEC, NPC, BSP, or criminal proceedings.

Frequently Asked Questions

Can I file a complaint even if I really owe the loan?

Yes. The existence of a debt and the legality of the collection method are separate questions. A borrower may remain responsible for a valid debt while the lender or collector is sanctioned for threats, shaming, deception, or privacy violations.

Can an online lending app contact my family, employer, or friends?

A genuine guarantor or co-maker may be contacted about the obligation. A character reference is not automatically a guarantor. Contacting relatives, employers, coworkers, or everyone in the borrower’s phone list to expose the debt or pressure the borrower is generally prohibited.

Does tapping “Allow Contacts” make the harassment legal?

No. Device permission does not authorize unrestricted or unlawful processing. Collection and use must still have a legitimate, declared, and proportionate purpose under the Data Privacy Act and NPC rules.

Is it automatically illegal to call before 6:00 a.m. or after 10:00 p.m.?

SEC MC No. 18 generally treats those hours as unreasonable, but it contains exceptions where the account is over 15 days past due or the borrower expressly agreed that those are the only convenient hours. Threats, insults, deception, and third-party harassment remain prohibited regardless of the time.

Can I be arrested for not paying an online loan?

Not merely because of the debt. The Constitution prohibits imprisonment for debt. A lender may file a civil case, and separate criminal liability requires facts supporting an actual offense rather than simple inability or failure to pay.

Can I file SEC and NPC complaints at the same time?

Yes, when the facts involve both unfair collection and misuse of personal data. The SEC regulates lending and collection conduct, while the NPC addresses privacy violations. Disclose all related proceedings truthfully, especially in the NPC certification against forum shopping.

What if the app is unregistered or has disappeared from the app store?

You may still report it. Preserve the app link, APK source, developer name, phone numbers, privacy policy, payment accounts, advertisements, and messages. Do not reinstall an unsafe APK merely to collect more evidence.

What if I never borrowed money but the app keeps contacting me?

You may complain as an affected data subject or third party. Tell the company in writing that you are neither the borrower nor a guarantor, demand removal of your information, preserve the communications, and use the NPC or SEC process where appropriate.

Can an OFW file a complaint from abroad?

Yes. SEC complaints can be initiated through iMessage. For an NPC complaint, a representative may act under a Special Power of Attorney. NPC rules expressly require certain complaints by non-resident Filipinos to be embassy- or consulate-notarized or apostilled.

Will filing a complaint erase my debt or stop interest automatically?

No. A complaint does not automatically cancel the loan, suspend all charges, or prevent a lawful collection case. Request an updated statement of account, dispute incorrect charges in writing, and make payments only through verified official channels.

Key Takeaways

A lender may collect a valid debt, but it may not threaten, deceive, shame, or harass the borrower or unrelated third persons.
Preserve complete digital evidence before blocking numbers, revoking permissions, or uninstalling the app.
Identify the legal company behind the app, not just the brand name.
File unfair collection complaints through the SEC iMessage portal and privacy complaints using the NPC’s current notarized Complaint-Affidavit.
Use the NBI or PNP promptly for credible threats, fake legal documents, hacking, identity misuse, or other possible crimes.
Harassment and debt liability are separate: reporting abuse does not automatically extinguish a valid loan.