An online lender may demand payment of a valid debt, but it cannot threaten you, shame you publicly, send insulting messages, misuse your photos, or contact everyone in your phonebook. If an online lending app is harassing you or people you know, preserve the evidence before deleting anything, identify the company behind the app, and report the conduct to the correct government agency. Depending on what happened, that may be the Securities and Exchange Commission (SEC), National Privacy Commission (NPC), Bangko Sentral ng Pilipinas (BSP), Philippine National Police Anti-Cybercrime Group (PNP-ACG), National Bureau of Investigation Cybercrime Division (NBI-CCD), or more than one of them.

What Counts as an Abusive Online Lending App?

Not every collection attempt is illegal. A lender may send reasonable payment reminders, explain the amount due, offer a restructuring arrangement, or pursue a lawful collection case.

Collection becomes potentially abusive when the lender, its employee, or a third-party collection agency uses tactics such as:

Threatening physical harm, arrest, deportation, loss of employment, or destruction of property
Calling you repeatedly at unreasonable hours
Using insults, obscenities, sexual remarks, or degrading language
Posting your name, photograph, identification card, or alleged debt on social media
Sending “wanted,” “scammer,” “estafa,” or similar posters to your contacts
Contacting your employer, co-workers, customers, relatives, or unrelated phone contacts to pressure you
Pretending to be a police officer, lawyer, court employee, government agency, or prosecutor
Sending fake warrants, subpoenas, court orders, or criminal complaints
Threatening legal action that the collector has no authority or genuine intention to take
Misrepresenting the amount owed, interest, penalties, or payment history
Demanding payment through an employee’s personal bank or e-wallet account
Continuing to use your contacts, photographs, location, or other device data beyond what is necessary for the loan
Harassing a person who was merely listed as a character reference and never agreed to guarantee the debt

The SEC’s rules prohibit violence or threats, insults amounting to abuse, publication of borrowers’ personal information, deceptive collection methods, and contact with people in the borrower’s contact list other than named guarantors or co-makers. Collection communications are generally prohibited before 6:00 a.m. or after 10:00 p.m., subject to limited exceptions in the rule. A lending or financing company remains responsible even when it hires an outside collection agency.

A March 18, 2026 joint advisory from the Department of Information and Communications Technology, NPC, and SEC also emphasized that online lending platforms must not use personal data to threaten, embarrass, publicly shame, or harass borrowers. It specifically prohibits contacting people in a borrower’s contact list for collection unless they are properly named guarantors.

Your Rights Under Philippine Law

A lender cannot use harassment simply because money is owed

The Lending Company Regulation Act of 2007, or Republic Act No. 9474, places lending companies under SEC regulation. Financing companies are also governed by the Financing Company Act and SEC rules.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, requires financial service providers to treat consumers fairly and prohibits abusive debt collection or recovery practices. (Lawphil)

SEC Memorandum Circular No. 18, Series of 2019, provides more specific rules against unfair debt collection by financing and lending companies. Among other things, collectors must use their real identities, avoid threats and abusive language, protect borrower information, and maintain a way for consumers to submit complaints. (SEC Appointment System)

Giving an app access to your contacts is not unlimited consent

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal-data processing to be transparent, based on a lawful purpose, and proportionate to that purpose.

NPC Circular No. 2022-02 prohibits online lenders from demanding unnecessary device permissions or obtaining unrestricted access to a borrower’s contact list. An app may provide a limited method for the borrower to select a legitimate character reference or guarantor, but it cannot treat the entire phonebook as a collection directory. Camera, gallery, and similar permissions should also be disabled or withdrawn when their stated purpose has been completed.

A character reference is not automatically a guarantor. A guarantor assumes a legal obligation to answer for another person’s debt and must knowingly agree to that role. Merely appearing in someone’s contacts, receiving an automated verification message, or being named as a reference does not make a person liable for the loan.

You cannot be imprisoned merely for failing to pay a debt

Article III, Section 20 of the 1987 Philippine Constitution states that no person may be imprisoned for debt or nonpayment of a poll tax. An ordinary unpaid online loan is generally a civil obligation, not an automatic criminal offense. (Lawphil)

This does not mean every situation involving a loan is immune from criminal investigation. A separate offense may exist when there is evidence of conduct such as identity theft, falsification, fraud from the beginning, or issuance of a bouncing check under circumstances covered by Batas Pambansa Blg. 22. A collector, however, cannot truthfully claim that police officers will arrest you immediately simply because an installment is overdue.

A genuine civil case normally involves formal pleadings and valid service of summons from a court. A text message containing a poorly formatted “warrant,” a collector’s demand letter labeled as a “final court order,” or a threat that police are already on the way is not a substitute for judicial process.

Threats, coercion, and public shaming may create separate liability

Depending on the exact words and conduct, abusive collection may potentially fall under provisions of the Revised Penal Code involving grave threats, coercion, unjust vexation, or libel. Online defamatory publication may also be examined under the Cybercrime Prevention Act of 2012, or Republic Act No. 10175, together with the Revised Penal Code provisions on libel. The Supreme Court discussed the application of cyber libel in Disini v. Secretary of Justice, G.R. No. 203335, February 11, 2014. (Lawphil)

Articles 19, 20, and 21 of the Civil Code may also support a claim for damages when a person willfully causes injury in a manner contrary to law, morals, good customs, or public policy. Whether a particular message or post satisfies the elements of a civil or criminal case depends on its wording, context, publication, authorship, and available evidence. (Lawphil)

Where to Report an Abusive Lending App

More than one agency may have jurisdiction. Filing with the SEC does not prevent you from reporting data misuse to the NPC or an actual threat to law enforcement.

What happened	Primary office to contact	What the office can address
A lending or financing company used unfair collection tactics	SEC Financing and Lending Companies Department	Licensing, regulatory violations, collection practices, administrative sanctions
The app copied contacts, used photos, messaged unrelated people, or publicly exposed personal data	National Privacy Commission	Violations of the Data Privacy Act and NPC lending-app rules
The provider is a bank, digital bank, e-money issuer, pawnshop, or another BSP-supervised institution	Institution’s consumer-assistance unit, then BSP	Consumer complaints involving BSP-supervised financial institutions
Messages contain credible threats, extortion, impersonation, hacking, identity theft, or cyber harassment	PNP-ACG, NBI-CCD, local police, or prosecutor	Criminal investigation and evidence preservation
The app or messages are part of an online scam or cyber incident	DICT Cyber Hotline and law enforcement	Cyber-incident referral and coordination
The app violates Google Play or Apple App Store rules	Relevant app store	Removal, restriction, or review of the app listing

The March 2026 government advisory lists the following current reporting channels:

SEC: SEC iMessage or hotline 1-4732 (1-4SEC)
DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph or (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph, onlinecims.ocs@gmail.com, or (02) 8723-0401 local 7491

How to Report an Abusive Online Lending App

1. Protect yourself when there is an immediate threat

If a collector threatens to come to your home, harm you, kidnap someone, damage property, or commit another immediate act of violence, prioritize safety.

Contact 911, your local police station, or the nearest PNP-ACG office. Tell the officer:

The exact threat made
When and how it was received
Whether the sender knows your address or workplace
Whether anyone has already appeared at your home
Whether children, elderly relatives, or other vulnerable people are involved

Do not arrange an in-person confrontation with the collector. Do not send additional identification documents merely because the sender claims they are needed to “cancel a warrant.”

2. Preserve evidence before uninstalling the app

Deleting the app too early can remove important information about permissions, the developer, the loan account, and the company behind the service.

Collect and preserve:

Screenshots of the app’s store listing, developer name, package or app ID, and privacy-policy link
Screenshots of the app’s profile, account number, balance, payment schedule, and customer-service details
Loan agreement, promissory note, disclosure statement, and terms and conditions
Proof of the amount actually received
Payment receipts and transaction reference numbers
Full screenshots of abusive messages, including the sender, date, and time
Call logs showing the number, frequency, and timing of calls
Social-media posts, comments, account links, and visible publication dates
Screenshots showing which device permissions the app requested
Copies of messages sent to your relatives, employer, co-workers, or friends
Names and contact details of witnesses
Emails or complaints already sent to the lender
Proof that the lender received your complaint

Keep the original files. Avoid relying only on cropped screenshots because the opposing party may question their context or authenticity. Back up evidence to another device or secure cloud account and prepare a simple chronology listing the date, event, person involved, and corresponding filename.

Electronic messages, digital photographs, and other electronic documents may be admitted as evidence when properly authenticated under the Rules on Electronic Evidence. A person who received a message directly may also help establish where it came from and what was displayed. (Lawphil)

3. Identify the company behind the app

An app’s brand name may be different from the registered corporate name of the lender.

Check:

The loan contract
Disclosure statement
App privacy notice
Terms and conditions
Payment instructions
Email footer
Google Play or Apple App Store developer information

Search the company through the SEC’s Check with SEC portal. Look for both corporate registration and the authority to operate as a lending or financing company. Corporate registration alone does not necessarily establish that a company is authorized to conduct a regulated lending business.

Record the company’s complete legal name, SEC registration number, Certificate of Authority number if shown, business address, website, email address, and names used by its collection agents.

If you cannot identify the company, state that clearly in your complaint and provide the app link, phone numbers, payment-account details, and screenshots. These identifiers can help regulators trace the operator.

4. Send a written complaint to the lender

Before filing a formal NPC case, a complainant ordinarily must first notify the company responsible for the data processing and allow it an opportunity to act. Under the amended NPC Rules of Procedure, a formal complaint may generally be filed when the company fails to respond within 15 calendar days, although the NPC may waive this requirement for good cause, serious or irreparable harm, or conduct that is patently illegal.

Send your complaint to the lender’s official customer-service address and, when available, its data protection officer. Include:

Your name and loan-account reference
The app and legal company name
The conduct being reported
Dates, phone numbers, and collector names
The people who were contacted
The personal data used or disclosed
The action you want taken

You may request that the company:

Stop contacting unrelated third parties
Stop publishing or sharing your personal information
Identify the collection agency and collector involved
Correct an inaccurate balance or payment record
Provide a complete statement of account
Preserve relevant system logs and communications
Confirm what personal data it holds and where the data came from
Restrict or delete data that is no longer lawfully needed
Investigate the collector and confirm the result in writing

Keep the sent email, delivery receipt, ticket number, and any response.

5. File a complaint with the SEC

The SEC’s current complaint system is SEC iMessage, which creates an electronic ticket and allows the complainant to monitor its status. Users sign in through the SEC’s eSECURE system, select the relevant service, complete the form, and upload supporting documents. (Securities and Exchange Commission)

For an abusive online lender, select:

Financing and Lending Companies Department → Complaints on Financing and Lending Companies

That service is handled by the department’s Legal and Enforcement Division.

Your SEC complaint should clearly distinguish between:

The valid loan obligation, if any
The collection conduct you are challenging
The individuals or third parties contacted
Any data-privacy issue
Any false statement about the amount due
Any threat, impersonation, or public shaming

Attach readable copies of your evidence. Use filenames such as 01_Loan_Agreement.pdf, 02_Message_Threat_July_10.png, and 03_Employer_Message.png so the reviewing officer can follow the sequence.

6. File a data-privacy complaint with the NPC

Use the NPC route when the abusive conduct involves contact-list scraping, disclosure of your debt, misuse of photos or identification documents, unauthorized messages to third parties, or excessive device permissions.

The NPC accepts a notarized complaint-assisted form or a verified complaint, together with supporting evidence and witness affidavits when available. It may be submitted personally, through registered mail or courier, or by scanned email to complaints@privacy.gov.ph. The official instructions and forms are available on the NPC complaint page. (National Privacy Commission)

A formal complaint should contain:

Names and addresses of the complainant and respondent
A clear statement of the facts
The privacy rights allegedly violated
The relief requested
Copies of correspondence with the lender
Screenshots and other supporting evidence
A verification under oath
A certification against forum shopping

Missing verification, evidence, or required information can result in dismissal.

The basic NPC complaint filing fee is ₱500, excluding notarization costs and any additional fee applicable when a specific monetary claim for damages is included.

NPC rules provide for assignment to an investigating officer within five calendar days after receipt. That is an internal assignment period, not a promise that the entire case will be resolved within five days. Service of documents, responses, mediation, investigation, and adjudication can make a formal case take substantially longer.

7. Use the BSP process when the provider is BSP-supervised

Some credit services are offered by banks, digital banks, e-wallet companies, or other entities supervised by the BSP rather than by an ordinary SEC-regulated lending company.

First submit the complaint to the institution’s own consumer-assistance or financial-consumer-protection mechanism. If the institution does not resolve the matter, elevate it through the BSP Online Buddy system or send the BSP Consumer Assistance and Resolution form to consumeraffairs@bsp.gov.ph. The BSP’s consumer-assistance telephone number is (02) 5306-2584. (Bureau of Small and Medium Enterprises)

When an e-wallet was merely used as the payment channel, determine who actually granted the loan. The lender and the payment provider may be different companies with different regulators.

8. Report credible criminal conduct

Report the matter to PNP-ACG or NBI-CCD when there is evidence of:

Credible threats of violence
Extortion
Identity theft
Hacking or unauthorized account access
Fake police or court documents
Impersonation of government officers
Fraudulent loans obtained in your name
Coordinated cyber harassment
Publication of defamatory content online

Bring printed copies and electronic copies of the evidence. Ask for the complaint reference, incident record, or other document showing that the report was received.

A police or cybercrime report does not automatically produce an arrest or criminal case. Investigators and prosecutors must determine whether the evidence satisfies the legal elements of an offense and whether the person responsible can be identified.

9. Report the app to the app store

Use the reporting function on Google Play or the Apple App Store to flag:

Harassment
Misuse of personal data
Deceptive financial practices
Unnecessary permissions
Impersonation
Malware or suspicious access
A mismatch between the listed developer and the lender

Include your government complaint reference number when the platform’s form allows it. App-store reporting is useful, but it does not replace a complaint with the SEC, NPC, BSP, or law enforcement.

10. Separate the debt dispute from the abuse complaint

Reporting harassment does not automatically cancel a legitimate loan.

Ask for a written statement showing:

Principal amount borrowed
Amount actually released
Finance charges
Interest rate
Late charges and penalties
Payments credited
Remaining balance
Legal name of the creditor

The Truth in Lending Act, or Republic Act No. 3765, requires disclosure of important credit information, including the amount financed, finance charge expressed in pesos, and applicable percentage rate. (Lawphil)

Pay only through verified official channels. Do not send money to a collector’s personal account unless the lender independently confirms in writing that the account is authorized. Keep every receipt.

If part of the balance is genuinely disputed, state the specific reason in writing rather than simply saying that you refuse to pay. You may acknowledge the undisputed principal while contesting hidden charges, uncredited payments, or abusive collection behavior.

What to Include in Your Complaint

A complaint is easier to investigate when it is factual, chronological, and specific. A useful structure is:

I obtained a loan through [app name], operated or represented as being operated by [company name], on [date]. I received ₱[amount] and was told to pay ₱[amount] on [date].

Beginning on [date], the company or its collectors used the following numbers or accounts: [list]. They sent the attached messages threatening [exact conduct].

On [date], they contacted [name and relationship], who was not a guarantor or co-maker, and disclosed [information disclosed]. On [date], they posted or sent my [photo, ID, debt information, or other data].

I complained to the company on [date] through [email or ticket]. It [did not respond/responded as follows].

I request an investigation, an order stopping the unlawful processing or collection conduct, preservation of relevant records, correction of my account where appropriate, and the sanctions or other relief authorized by law.

Avoid exaggeration. Quote the collector’s exact words where important, identify which statements are your conclusions, and explain how each attachment supports your allegation.

Documents, Costs, and Timing

Item	Practical requirement
SEC complaint	iMessage account, company/app details, narrative, and supporting files
NPC complaint	Verified or notarized complaint, correspondence with the company, evidence, requested relief, and certification against forum shopping
NPC basic filing fee	₱500, plus notarization and possible additional fees for monetary claims
Police or cybercrime report	Identification, chronology, screenshots, phone numbers, account links, witness information, and original electronic files where available
Prior company complaint for NPC cases	Ordinarily required; allow up to 15 calendar days for action unless the NPC waives exhaustion for a recognized reason
SEC ticket timing	Track through iMessage; response time depends on completeness, jurisdiction, and investigation required
NPC timing	Assignment may occur within five calendar days, but formal proceedings can continue for months
Criminal investigation	Varies according to urgency, identification of the suspect, platform records, and sufficiency of evidence

Do not pay a private “processor,” collector, or fixer who claims that a government complaint can be withdrawn, accelerated, or erased in exchange for money.

Common Mistakes That Weaken a Complaint

Deleting the app before recording its details

Capture the app page, permissions, developer identity, privacy notice, account information, and payment instructions first. After preserving evidence, you may revoke unnecessary permissions and uninstall the app to stop further device access.

Blocking every number before saving the messages

Blocking may be necessary for safety and peace of mind, but first preserve the complete conversation and sender information. Messages forwarded by relatives should show the original sender, date, and time.

Reporting only the app’s brand name

Identify the legal lender, developer, collection agency, payment recipient, and phone numbers whenever possible. Several apps may use similar names, and a single operator may use multiple brands.

Assuming permission to access contacts permits debt shaming

Even when a borrower clicked “allow,” processing must still be lawful, necessary, and proportionate. General device permission does not authorize indiscriminate collection messages to relatives, employers, customers, or unrelated contacts.

Ignoring a genuine court document

Collectors frequently misuse legal language, but a real summons or subpoena should not be ignored. Verify the branch, case number, issuing office, signatures, and contact details independently through official court or government channels.

Posting accusations without preserving proof

Publicly naming employees or companies without careful factual support may create a separate defamation dispute. Give detailed evidence to regulators and investigators rather than engaging in an online insult campaign.

Paying a stranger who promises to stop the harassment

Confirm any settlement directly with the lender through an official email address or customer-service channel. Obtain a written breakdown and, after full settlement, written confirmation that the account has been paid or closed.

Special Situations

The loan was taken using your identity

Immediately dispute the loan in writing. Ask the lender to freeze collection, preserve onboarding records, and provide the application data, device information, identification documents, selfie-verification records, disbursement account, and transaction trail.

Report suspected identity theft to PNP-ACG or NBI-CCD and report any misuse of your personal information to the NPC. Do not pay merely to stop harassment if you did not obtain or benefit from the loan.

Your relatives or employer were contacted

Ask each recipient to preserve the original message. Their screenshots and sworn statements can corroborate your complaint.

A relative, co-worker, or employer whose own personal data was misused may also have an independent privacy complaint. Being contacted does not make that person responsible for your debt unless the person knowingly entered into a valid guaranty or co-maker arrangement.

You are outside the Philippines

Complaints may still be filed electronically where the agency permits it. For NPC proceedings, a non-resident Filipino citizen who has no representative in the Philippines must have the complaint notarized through a Philippine embassy or consulate or obtain an apostille from the country of origin, as provided by the amended NPC Rules of Procedure.

A foreign national may report conduct involving personal data processed within the scope of Philippine data-protection law, but jurisdiction and authentication requirements can depend on the company, processing activity, and complainant’s location. Include a clear explanation of the Philippine connection and ask the NPC which form of notarization or authentication it requires.

The lender is unregistered or has disappeared

Report the app and all available identifiers to the SEC. Also provide the payment-account name, bank or e-wallet used, phone numbers, website, app-store page, email domains, and social-media accounts.

If the transaction appears fraudulent rather than merely unlicensed, report it to PNP-ACG, NBI-CCD, and the relevant bank or e-wallet provider. Request prompt preservation of transaction records.

Frequently Asked Questions

Can an online lending app post my picture on Facebook?

Using your photograph and alleged debt to shame or pressure you may violate SEC collection rules, the Data Privacy Act, and potentially civil or criminal laws depending on the content. Save the post, URL, account name, date, comments, and sharing information before requesting removal.

Can a lender call everyone in my contacts?

No. Online lenders are prohibited from using unrestricted contact-list access for collection and may not contact people in your phonebook other than properly named guarantors or co-makers. A character reference is not automatically a guarantor.

Can I be arrested for not paying an online loan?

You cannot be imprisoned merely for debt. A lender may pursue lawful civil remedies, but an overdue loan does not by itself authorize immediate arrest. Separate criminal conduct, if supported by evidence, is a different matter.

Should I complain to the SEC or the NPC?

Complain to the SEC about the lending company and its collection practices. Complain to the NPC about misuse or disclosure of personal data. When harassment includes both unfair collection and data misuse, filing with both agencies may be appropriate.

Should I uninstall the abusive loan app?

First preserve evidence, including the app identity, permissions, account details, privacy notice, and messages. You may then revoke unnecessary permissions and uninstall the app. Changing your phone number or resetting the device before preserving evidence can make investigation more difficult.

Does filing a complaint erase my loan?

No. The complaint concerns unlawful conduct, regulatory violations, or inaccurate charges. A valid principal obligation may remain payable. Request a complete statement of account and separate the legitimate debt from charges or conduct you dispute.

How long does a complaint take?

Simple company-level complaints may be addressed quickly, while regulatory investigations and formal NPC or criminal proceedings can take months. Completeness of evidence, identification of the operator, service of notices, responses, mediation, and investigation all affect the timeline.

Can my employer fire me because a lender contacted the office?

A collector’s accusation does not establish wrongdoing. Employment consequences depend on the facts, workplace policies, and applicable labor law. Give your employer a calm written explanation, preserve the collector’s message, and state that the unauthorized disclosure has been reported. Do not allow the collector to pressure payroll or human-resources staff into releasing your salary or personal records.

What if I already paid but the harassment continues?

Send the lender your receipts and request a reconciliation and written confirmation of the remaining balance or account closure. Report continued harassment, false balance claims, or failure to credit payments to the SEC. Report any continued disclosure to third parties to the NPC.

Key Takeaways

A lender may collect a valid debt, but it may not use threats, insults, public shaming, deception, or indiscriminate contact-list messaging.
Preserve screenshots, app information, account records, call logs, payment receipts, and messages sent to third parties before uninstalling the app.
Report unfair collection by lending and financing companies through SEC iMessage.
Report contact-list scraping, debt disclosure, photo misuse, and other personal-data violations to the NPC.
Report credible threats, impersonation, identity theft, extortion, or cyber harassment to PNP-ACG or NBI-CCD.
Use the institution’s complaint process and then the BSP when the credit provider is BSP-supervised.
A character reference is not automatically a guarantor and is not responsible for the borrower’s debt.
Filing a complaint does not erase a legitimate loan, but it can stop or sanction unlawful collection practices.