Being chased, threatened, or publicly shamed by an online lending app can feel overwhelming, especially when collectors message your family, employer, Facebook friends, or phone contacts. In the Philippines, a lending company may collect a legitimate debt, but it cannot use harassment, threats, contact-list shaming, fake legal documents, or abusive handling of your personal data. This guide explains where to report abusive online lending apps, what evidence to prepare, which Philippine laws apply, and how to file with the SEC, NPC, PNP, NBI, or DICT depending on what happened.

Is abusive online lending app behavior illegal in the Philippines?

Yes. The law recognizes that creditors have the right to collect unpaid loans, but that right has limits.

An online lending app, financing company, lending company, or third-party collector may not collect in a way that violates your dignity, privacy, reputation, safety, or legal rights. The Securities and Exchange Commission (SEC), National Privacy Commission (NPC), Department of Information and Communications Technology (DICT), National Bureau of Investigation Cybercrime Division, and Philippine National Police Anti-Cybercrime Group have specifically warned the public about online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data.

The most common reportable acts include:

Threatening to post your name, photo, ID, or loan details online
Messaging your relatives, friends, co-workers, employer, or phone contacts about your debt
Calling or texting at unreasonable hours
Using insults, profanity, sexual harassment, or degrading language
Sending fake subpoenas, fake arrest warrants, fake barangay notices, or fake court documents
Pretending to be a lawyer, police officer, NBI agent, barangay official, or court employee
Accessing your contact list, gallery, camera, location, or files beyond what is necessary
Publishing your personal data or making “wanted,” “scammer,” or “estafa” posts about you
Threatening physical harm, imprisonment, deportation, blacklisting, or public humiliation

The important point is this: owing money does not give a lender the right to harass you or misuse your personal data.

Which government agency should you report to?

Use the agency that matches the violation. In many online lending app cases, you may need to file with more than one agency because the same incident can involve unfair debt collection, data privacy violations, and cybercrime.

Problem	Main agency to report to	Best for
Harassing collection calls, threats, public shaming, contacting non-guarantor contacts	SEC Financing and Lending Companies Department (FINLEND)	Unfair debt collection by lending or financing companies
Accessing or using your contact list, photos, ID, phone data, or personal details without proper basis	National Privacy Commission (NPC)	Data Privacy Act complaints
Threats, fake warrants, cyber libel, identity misuse, extortion, scams, hacking, or serious online harassment	PNP Anti-Cybercrime Group / NBI Cybercrime Division / DICT Cyber Hotline	Cybercrime investigation
The lender is a bank, credit card issuer, e-wallet, or BSP-supervised financial institution	Bangko Sentral ng Pilipinas (BSP)	Consumer complaints against BSP-supervised entities
The lender is a cooperative	Cooperative Development Authority (CDA)	Complaints against lending cooperatives

For unfair debt collection practices by lending and financing companies, the 2026 DICT-NPC-SEC advisory directs the public to submit complaints through the SEC iMessage complaint portal and lists the SEC hotline as 1-4732 or 1-4SEC.

Legal basis: your rights against abusive online lending apps

SEC regulation of lending and financing companies

Lending companies are regulated under Republic Act No. 9474, or the Lending Company Regulation Act of 2007. The law places lending companies under SEC supervision and authorizes the SEC to issue rules for their operation. (Lawphil)

Financing companies are separately regulated under Republic Act No. 8556, or the Financing Company Act of 1998, as amended. SEC Memorandum Circular No. 18, Series of 2019 expressly applies to both financing companies and lending companies, including third-party service providers used for collection.

Under SEC Memorandum Circular No. 18, Series of 2019, the following are prohibited unfair collection practices:

Use or threat of violence or criminal means
Threats to take action that cannot legally be taken
Obscene, insulting, or profane language
Disclosure or publication of borrowers’ names and personal information
Telling other people about the loan when the information is false, disputed, or should not be disclosed
False representation or deceptive means to collect
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to specific exceptions
Contacting persons in the borrower’s contact list other than those named as guarantors or co-makers, even if the borrower supposedly consented

The SEC circular also makes lending and financing companies responsible for collectors and third-party service providers they hire. They cannot avoid liability by saying, “collection agency lang po iyon.”

Online lending platforms must be reported and properly disclosed

SEC Memorandum Circular No. 19, Series of 2019 requires disclosure in advertisements of financing and lending companies and reporting of online lending platforms. The SEC’s official issuances page lists MC No. 19 s.2019 as covering disclosure requirements in advertisements and reporting of online lending platforms. (SEC Appointment System)

In practice, this means you should check whether:

The company name appears in SEC records
The lending or financing company has a Certificate of Authority
The app or website is listed as a recorded online lending platform
The app clearly discloses the corporate name, SEC registration details, Certificate of Authority number, interest, fees, charges, and loan terms

A mobile app name is often different from the SEC-registered company name. For example, the app may have a short brand name, while the legal entity behind it is a corporation with a different registered name.

Data Privacy Act protection

Republic Act No. 10173, or the Data Privacy Act of 2012, protects personal information in government and private information systems and created the National Privacy Commission. (Lawphil)

For online lending, the key NPC issuance is NPC Circular No. 20-01, the Guidelines on the Processing of Personal Data for Loan-Related Transactions, later amended by NPC Circular No. 2022-02. These rules were issued because of complaints against online lending apps accessing phone contact lists, camera, location, storage, and other phone data. (National Privacy Commission)

The 2026 DICT-NPC-SEC advisory makes the rule very clear:

Unnecessary app permissions are prohibited.
Excessive or disproportionate access to contact lists is prohibited.
Processing personal data to harass borrowers or collect from people outside the guarantors is prohibited.
Online lending platforms may only contact the guarantor for debt collection purposes.
A character reference is not automatically a guarantor.
A guarantor must have separately consented to be responsible for the loan.

Cybercrime and criminal laws

Some abusive collection acts can become criminal matters.

Possible legal bases include:

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, for cyber-related offenses and online libel. (Lawphil)
Revised Penal Code, Article 282, for grave threats
Revised Penal Code, Article 286, for grave coercion
Revised Penal Code, Article 287, for unjust vexation or related coercive acts
Revised Penal Code, Articles 353 and 355, for libel by writing or similar means
Cyberlibel under RA 10175, when defamatory posts or messages are made through a computer system or online platform

In Disini v. Secretary of Justice, the Supreme Court upheld cyberlibel under the Cybercrime Prevention Act but limited liability for certain online libel situations to the original author of the libelous statement. (Lawphil)

Truth in Lending Act

If the complaint involves hidden fees, misleading interest, undisclosed deductions, unclear penalties, or a much smaller released amount than what was advertised, Republic Act No. 3765, or the Truth in Lending Act, may also be relevant. The law requires disclosure of finance charges in credit transactions. (Lawphil)

Step-by-step guide: how to report an abusive online lending app

1. Preserve evidence before blocking or deleting anything

Before uninstalling the app, changing phones, or deleting messages, save evidence.

Prepare:

Screenshots of all messages, including the sender name, number, date, and time
Screen recordings showing the app name, loan account, threats, or pop-up messages
Call logs showing repeated calls
Voice recordings, if available
Copies of emails, SMS, Messenger, Viber, Telegram, WhatsApp, or Facebook messages
Screenshots of public posts, comments, group chats, or “shaming” materials
Copies of fake warrants, fake subpoenas, fake barangay notices, or fake legal letters
Loan agreement, disclosure statement, repayment schedule, and proof of disbursement
Proof of payments already made
App store link, website link, APK file source, or ads used by the app
Names and numbers of collectors
Names of relatives, friends, or co-workers contacted
Affidavits or written statements from people who received harassment messages

For online evidence, capture the full context. A screenshot that shows only one threatening sentence may be less useful than a screenshot showing the profile, number, date, time, message thread, and account name.

2. Identify the lending app and company behind it

Do not rely only on the app name. Look for:

App name
Developer name in Google Play, Apple App Store, APK site, Facebook page, or website
Corporate name in the loan agreement
SEC registration number
Certificate of Authority number
Business address
Customer service email
Data Protection Officer contact details
Name of collection agency or third-party collector

Then check the SEC records for lending and financing companies and recorded online lending platforms. The SEC has repeatedly directed the public to verify registered lending companies, financing companies, and recorded online lending platforms through its official website. (www.foi.gov.ph)

If the app is not recorded, still report it. Unrecorded or unauthorized apps are often exactly the ones regulators need to investigate.

3. File a complaint with the SEC for unfair debt collection

For harassment, threats, third-party contact, public shaming, misleading collection tactics, or unrecorded online lending operations, file with the SEC Financing and Lending Companies Department (FINLEND) through the SEC iMessage portal. The SEC iMessage system is the SEC’s web-based platform for inquiries, complaints, incidents, and requests, and it generates an electronic ticket for tracking. (imessage.sec.gov.ph)

In your SEC complaint, include:

Your full name, contact number, and email address
App name and corporate name, if known
Website, app store link, Facebook page, or APK source
Loan account number, if available
Date of loan application and amount released
Amount demanded by the app
Clear timeline of what happened
Exact abusive acts complained of
Names, numbers, or accounts used by collectors
List of third parties contacted
Attachments showing screenshots, call logs, posts, fake documents, and proof of payments

A practical way to write the facts is chronological:

“On 10 March 2026, I borrowed ₱5,000 through the app.”
“On 17 March 2026, before due date, a collector using number ____ called me 18 times.”
“On 18 March 2026, the collector messaged my employer and sent my ID.”
“On 19 March 2026, my photo was posted in a Facebook group calling me a scammer.”
“Attached are screenshots marked Annexes A to H.”

Ask the SEC to investigate for violations of SEC MC No. 18 s.2019, SEC MC No. 19 s.2019, RA 9474, RA 8556 if applicable, and RA 11765 if the facts involve financial consumer protection.

4. File with the NPC for data privacy violations

File with the National Privacy Commission if the lending app:

Accessed your contact list without a proper, specific, and proportionate purpose
Used your contacts to pressure you
Sent your loan details to relatives, friends, employer, or co-workers
Used your photo, ID, selfie, or personal documents to shame you
Required excessive permissions
Made it hard to withdraw consent or disable permissions
Continued processing your personal data after the purpose was finished
Failed to provide a clear privacy notice

The NPC requires formal complaints to follow a specific format. Its complaint page instructs complainants to download the complaint form, print and fill it out, have it notarized, then submit it in person, by courier, or by scanning and emailing it to the NPC complaints email. (National Privacy Commission)

The NPC also announced that a new Complaint-Affidavit template took effect on 1 July 2025, so use the current form from the NPC website. (National Privacy Commission)

For an NPC complaint, attach:

Notarized complaint-affidavit
Government-issued ID
Screenshots of app permissions
Privacy policy or consent screen, if available
Screenshots showing contacts were messaged
Statements from contacts who received messages
Screenshots of public posts or threats
Loan documents and app details
Any reply from the lender’s Data Protection Officer or customer service

If you are abroad, notarization can be more complicated. A Filipino overseas may execute documents before a Philippine Embassy or Consulate where available. If using a foreign notary, the document may need an apostille or authentication depending on where it was notarized and how the receiving agency treats the document. Always keep scanned copies and courier tracking.

5. Report threats, cyber harassment, fraud, or fake legal documents to cybercrime authorities

Go to cybercrime authorities when the conduct goes beyond collection misconduct and becomes threatening, fraudulent, or criminal.

The 2026 DICT-NPC-SEC advisory lists the following channels for other forms of harassment, threats, frauds, and scams:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph and onlinecims.ocs@gmail.com; telephone (632) 8723-0401 local 7491

The NBI also lists its Cybercrime Division and official email on its divisions page. (National Bureau of Investigation)

Bring or submit:

Printed screenshots
Digital copies on USB or cloud folder
Your valid ID
A written timeline
Names and contact details of witnesses
The phone used to receive the threats, if investigators need to inspect it
Links to online posts, profiles, or pages
Proof that the threatening account is connected to the lending app, if available

For serious threats of physical harm, stalking, extortion, or threats involving your home or workplace, report immediately to the nearest police station as well.

6. Report the app to Google Play, Apple App Store, Facebook, or the hosting platform

This does not replace a government complaint, but it helps stop further harm.

Report:

The app listing
The developer account
Fake Facebook pages or groups
Public shaming posts
Impersonation accounts
Ads using misleading claims

Attach your government complaint ticket number if you already have one. Platforms are more likely to act when the report is specific and documented.

7. Follow up using your ticket numbers and keep a case folder

Create one folder for everything:

SEC ticket number
NPC complaint reference
PNP/NBI/DICT reference number
Copies of all submissions
A master timeline
Evidence annexes
Proof of courier or email submission
Follow-up emails and replies

Do not send scattered screenshots without explanation. Agencies process complaints faster when your evidence is organized.

Evidence checklist for online lending app harassment

Evidence	Why it matters
Screenshots with date, time, sender, and full message thread	Shows what was said and when
Call logs	Proves frequency and timing of calls
Messages sent to relatives, friends, employer, or contacts	Supports SEC and NPC complaints
Public posts using your name, photo, ID, or loan details	Supports privacy, cyberlibel, and harassment reports
Loan agreement and disclosure statement	Shows the real loan terms and possible Truth in Lending issues
Proof of disbursement	Shows how much you actually received
Proof of payments	Prevents false claims that you never paid
App permissions screenshots	Supports privacy complaint for excessive data access
App store page or APK source	Helps identify the operator
Fake legal documents	Supports fraud, misrepresentation, or cybercrime report
Witness statements	Helps when your contacts were harassed

Common mistakes that weaken a complaint

Deleting the messages too early

Many victims delete everything out of fear or embarrassment. Preserve evidence first. If you need to block the collector for your peace of mind, screenshot and export the messages first.

Reporting only the app name

The SEC and NPC need the company behind the app. Include the app name, developer name, corporate name, website, phone numbers, and any registration details shown in the app.

Sending emotional statements without a clear timeline

It is understandable to feel angry or afraid, but agencies need facts. A simple chronological timeline is more useful than a long narrative without dates.

Forgetting third-party evidence

If your mother, spouse, employer, or friend received threats, ask them to save screenshots from their own phones. Their evidence is often stronger than your statement alone.

Assuming “consent” makes everything legal

A lending app may argue that you consented when you installed the app. That does not automatically legalize excessive contact-list access, harassment, public shaming, or contacting non-guarantors. The 2026 advisory specifically states that contacting persons in the borrower’s contact list other than named guarantors is prohibited for debt collection.

Ignoring fake legal threats

Collectors sometimes send fake “warrants,” fake “subpoenas,” or messages saying “criminal case filed today.” Real court processes do not work that way. Arrest warrants are issued by courts, not by lending apps, collectors, or private lawyers. If a document looks fake, save it and include it in your cybercrime report.

What usually happens after you report?

Timelines vary because agencies must review the evidence, identify the company, verify registration, and sometimes coordinate with other offices.

Agency	What usually happens
SEC	Complaint is received through iMessage, assigned a ticket, reviewed for lending/financing jurisdiction, and may lead to inquiry, order, fine, suspension, revocation, or referral
NPC	Complaint is checked for form and completeness; notarization and proper affidavit format are common bottlenecks
PNP/NBI	Investigator may require a sworn statement, printed evidence, phone inspection, or in-person appearance
DICT Cyber Hotline	May assist with reporting, coordination, or referral to the proper cybercrime channel
App platforms	May remove, suspend, or restrict apps or posts if platform rules are violated

Do not expect every report to result in immediate arrest or instant deletion of the app. Administrative investigations and cybercrime investigations take time. A well-organized complaint improves the chance that the agency can act.

Practical scenarios

The app messaged my family and employer

This is one of the clearest red flags. Under SEC MC No. 18 s.2019 and the 2026 DICT-NPC-SEC advisory, contacting people in your contact list other than named guarantors or co-makers is prohibited for debt collection. File with the SEC for unfair collection and with the NPC for misuse of personal data.

The app posted my photo and called me a scammer

Save the post, URL, profile, comments, and shares. File with the SEC, NPC, and cybercrime authorities. Depending on the words used, this may involve privacy violations, cyber harassment, and possible cyberlibel.

I borrowed money, but the interest and penalties are much higher than expected

Ask for the disclosure statement, computation, and payment history. File with the SEC if the lender is a lending or financing company. RA 3765, the Truth in Lending Act, requires disclosure of finance charges in credit transactions.

The collector says I will be arrested for not paying

Nonpayment of a simple loan is generally a civil obligation, not automatic imprisonment. However, separate criminal liability may arise if there is fraud, identity theft, falsified documents, or other criminal acts. A collector cannot simply order your arrest. Save the threat and report it.

I am an OFW or foreigner outside the Philippines

You can still report. Use the online portals and email channels where available. For notarized affidavits, coordinate with the Philippine Embassy or Consulate, or prepare a locally notarized and apostilled document if needed. Include a Philippine contact address only if you have one; otherwise, clearly state your foreign address and email.

I did not borrow, but the app says I am a reference or guarantor

A character reference is not the same as a guarantor. A guarantor must separately consent to assume responsibility for the loan. If you are being harassed even though you did not borrow or guarantee the loan, save the messages and file with the NPC and cybercrime authorities. The borrower may also file with the SEC if the harassment is part of collection.

Frequently Asked Questions

Can I report an online lending app even if I really owe money?

Yes. A valid debt does not legalize harassment, threats, public shaming, or misuse of personal data. Your complaint should focus on the abusive conduct, not merely on the existence of the debt.

Where do I report online lending app harassment in the Philippines?

For unfair debt collection by lending or financing companies, report to the SEC through the iMessage portal. For privacy violations involving contact lists, photos, IDs, or personal data, file with the NPC. For threats, scams, fake legal documents, cyberlibel, or identity misuse, report to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.

Can an online lending app contact my contacts?

For debt collection, the 2026 DICT-NPC-SEC advisory states that lending and financing companies, online lending platforms, and persons acting as such may only contact the guarantor. Contacting persons in the borrower’s contact list other than named guarantors is prohibited.

Is a character reference liable for my loan?

No, not merely because they were listed as a character reference. A guarantor must separately consent to be responsible for the loan. A reference is generally for identity or verification, not payment responsibility.

Can I file a complaint with the NPC by email?

Yes, but the NPC requires a formal complaint in the proper format. Its complaint page instructs complainants to download the form, print and fill it out, have it notarized, then submit it in person, by courier, or by scanning and emailing it to the NPC complaints email. Use the current NPC complaint-affidavit template.

Can I be jailed for not paying an online loan?

Mere nonpayment of debt is generally not a crime. However, separate criminal issues may arise if there was fraud, falsification, identity theft, or other criminal conduct. Collectors cannot truthfully say you will automatically be arrested just because you missed a payment.

What if the lending app is not registered with the SEC?

Still report it. Unregistered or unrecorded online lending platforms may be operating illegally or without proper authority. Include the app link, screenshots, developer name, phone numbers, and all available identifying details.

Should I uninstall the lending app?

Preserve evidence first. Screenshot the app name, account details, loan records, permissions, privacy notices, and messages. After preserving evidence, you may revoke unnecessary permissions, change passwords, secure your accounts, and uninstall if needed for safety.

What if the collector uses different numbers every day?

List all numbers in your complaint. Attach call logs and screenshots. State that the collector appears to be using multiple numbers. This pattern can help show harassment or coordinated collection activity.

Can foreigners report abusive Philippine online lending apps?

Yes. Foreigners who are borrowers, references, guarantors, victims of identity misuse, or affected contacts may report to Philippine agencies if the lender, app, collector, or harmful conduct is connected to the Philippines. The same evidence rules apply.

Key Takeaways

Report unfair debt collection to the SEC, especially harassment, threats, public shaming, and contacting non-guarantor contacts.
Report misuse of personal data to the NPC, especially contact-list scraping, posting IDs or photos, or excessive app permissions.
Report threats, scams, fake warrants, cyberlibel, and identity misuse to PNP ACG, NBI Cybercrime Division, or DICT Cyber Hotline.
SEC MC No. 18 s.2019 prohibits abusive collection practices by lending and financing companies and their third-party collectors.
NPC rules prohibit excessive and disproportionate processing of personal data for loan-related transactions.
A character reference is not automatically a guarantor.
Owing money does not give a lending app the right to shame, threaten, or expose you.
Strong complaints are built on organized evidence: screenshots, call logs, loan documents, witness statements, app details, and a clear timeline.