When an online lending app threatens to message your contacts, post your face or ID, call your employer, shame you online, or expose private photos unless you pay, treat it as a reportable legal problem—not just “normal collection.” In the Philippines, a lender may collect a valid debt, but it cannot use threats, public humiliation, misuse of your contact list, blackmail, or abusive messages to force payment. This guide explains what counts as online lending app harassment, which government office to approach, what evidence to prepare, and how to report the incident step by step.

What Counts as Online Lending App Harassment or Blackmail?

Online lending app harassment usually happens when a loan app, collector, agent, or third-party collection agency uses fear, shame, or your personal data to pressure you into paying.

Common examples include:

Threatening to message your family, friends, employer, co-workers, customers, or social media contacts
Sending “scammer,” “wanted,” “estafa,” or “huwag pautangin” messages to people in your phonebook
Posting or threatening to post your face, government ID, selfies, address, or loan details online
Using profanity, insults, sexual remarks, or degrading language in calls or chats
Calling or texting repeatedly very early in the morning, late at night, or from many different numbers
Claiming they will have you arrested immediately, send police to your house, or issue a fake warrant
Pretending to be a lawyer, court officer, police officer, barangay official, or government agency
Threatening to edit, publish, or circulate intimate photos or private videos
Accessing your phone contacts, photo gallery, or social media accounts beyond what is necessary for the loan
Demanding extra “settlement fees,” “lawyer fees,” or “penalties” that were not properly disclosed

The debt and the harassment are two separate issues. A borrower may still need to settle a legitimate loan, but a valid debt does not give a lender the right to threaten, shame, blackmail, or misuse personal data.

Your Rights Under Philippine Law

SEC rules prohibit unfair debt collection by lending and financing companies

The Securities and Exchange Commission regulates lending companies and financing companies in the Philippines. SEC Memorandum Circular No. 18, series of 2019, specifically prohibits unfair debt collection practices by financing companies, lending companies, and their third-party service providers. The SEC issued the circular after receiving numerous complaints about unreasonable, abusive, and unfair collection practices. (SEC Appointment System)

Under SEC MC No. 18, collectors are prohibited from using threats of violence or other criminal means to harm a person, reputation, or property. They are also prohibited from threatening legal action that cannot legally be taken, using obscene or insulting language, publishing borrowers’ names or personal information to shame them, spreading false information about a debt, and using deceptive means to collect.

The SEC rules also restrict collection calls and messages before 6:00 a.m. and after 10:00 p.m., subject to limited exceptions. More importantly, even if a borrower gave some form of consent, contacting people in the borrower’s contact list—other than guarantors or co-makers—is treated as an unfair debt collection practice.

A lender cannot avoid responsibility by saying “collection agency lang po iyan.” SEC MC No. 18 says the financing or lending company remains ultimately responsible for the conduct of its collection agents and third-party service providers.

Borrowers are financial consumers with protection against abusive collection

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, recognizes the rights of financial consumers to fair and respectful treatment, privacy and data protection, proper disclosure, and access to a consumer assistance mechanism. It expressly includes protection against abusive collection or debt recovery practices. (Supreme Court E-Library)

RA 11765 also makes financial service providers responsible for the acts and omissions of their agents and third-party service providers. This matters because many online lending apps use outsourced collectors, call centers, or anonymous numbers. The regulated lender may still be answerable for abusive collection done on its behalf. (Supreme Court E-Library)

Loan apps cannot freely use your contacts, photos, or personal data

Republic Act No. 10173, the Data Privacy Act of 2012, protects personal information in both government and private-sector systems. In online lending cases, the National Privacy Commission has issued specific rules on how lending apps may process borrower data. (National Privacy Commission)

NPC Circular No. 2022-02 makes clear that access to a phone’s camera or photo gallery must be limited to legitimate purposes, such as Know-Your-Customer verification or payment confirmation. Photos obtained for loan verification must not be used to harass, embarrass, or humiliate borrowers.

The NPC also prohibits unbridled processing of contact lists. “Contact list” is broadly understood to include phone contacts, email contacts, and social media contacts. Processing contact information in a way that leads to harassment, unfair collection, or collection from people other than guarantors is prohibited.

In March 2026, the DICT, NPC, and SEC issued a joint public advisory reminding online lending platforms that contacting people in a borrower’s contact list—other than named guarantors—for debt collection is prohibited. The advisory also emphasized that guarantors must give separate, express consent and that character references and guarantors must be handled through separate interfaces.

Threats and blackmail may also be criminal offenses

“Blackmail” is the common word people use, but under Philippine law the conduct may fall under different offenses depending on the facts.

Possible legal bases include:

Grave threats or light threats under the Revised Penal Code, when the collector threatens harm to your person, reputation, family, or property
Coercion, when a person uses force, intimidation, or threats to make you do something against your will
Unjust vexation, for persistent acts meant to annoy, distress, or harass
Oral defamation, slander by deed, or libel, when false and damaging statements are made about you
Cyberlibel or other cybercrime offenses under RA 10175, the Cybercrime Prevention Act, when the acts are committed through text, chat, social media, email, websites, or other computer systems
Identity theft or computer-related fraud/forgery, when fake accounts, false profiles, altered documents, or impersonation are used online

The Cybercrime Prevention Act covers computer-related forgery, fraud, and identity theft, and also covers online libel committed through a computer system. It also authorizes the NBI and PNP to organize cybercrime units and investigate cybercrime offenses. (Supreme Court E-Library)

If the threat involves intimate photos or videos, RA 9995, the Anti-Photo and Video Voyeurism Act of 2009, may be relevant. If the conduct involves gender-based online sexual harassment, RA 11313, the Safe Spaces Act, may also apply. (Supreme Court E-Library)

Where to Report Online Lending App Harassment in the Philippines

You may need to report to more than one office because each agency handles a different part of the problem.

Situation	Office to Approach	What the Office Can Address
Unfair collection, threats, public shaming, contacting your contacts, abusive collectors	SEC Financing and Lending Companies Department	Administrative complaint against the lending or financing company; possible penalties, suspension, or revocation
Misuse of contact list, ID photos, selfies, phone permissions, personal data, employer/family contacts	National Privacy Commission	Data privacy complaint, investigation, compliance orders, and penalties
Blackmail, threats, fake accounts, cyberlibel, identity theft, extortion, intimate-photo threats	NBI Cybercrime Division or PNP Anti-Cybercrime Group	Criminal investigation and possible referral for prosecution
Immediate threats to your safety or people coming to your house	Local police station and barangay blotter, then NBI/PNP cybercrime if online	Immediate incident record and safety response
Fake Facebook pages, TikTok posts, Google reviews, app store listings, or public posts	Platform report tools plus SEC/NPC/NBI/PNP	Takedown request, but not a substitute for legal reporting

The 2026 DICT-NPC-SEC advisory identifies reporting channels for abusive online lending practices, including SEC FINLEND through SEC iMessage and hotline 1-4732, DICT Cyber Hotline email 1326@dict.gov.ph, NBI Cybercrime Division email ccd@nbi.gov.ph, and PNP Anti-Cybercrime Group emails acg@pnp.gov.ph and onlinecims.ocs@gmail.com.

Step-by-Step Guide: How to Report Online Lending App Harassment

1. Preserve evidence before blocking, deleting, or uninstalling anything

Do this first. Many borrowers panic and delete the app, clear messages, or block everyone immediately. That may make the harassment stop for a while, but it can also destroy evidence.

Save:

Screenshots of all threatening messages, including the sender’s number, username, profile link, date, and time
Full screenshots of chat threads, not just isolated lines
Screen recordings showing the entire conversation from top to bottom
Call logs showing repeated calls, unusual hours, and multiple numbers
Voicemails, if any
Messages sent to your family, friends, employer, co-workers, or customers
Screenshots of public posts, fake pages, edited photos, or defamatory captions
The app name, developer name, website, Play Store or App Store listing, and privacy policy
Loan agreement, disclosure statement, repayment schedule, screenshots of the amount received, and repayment receipts
Proof of payments through GCash, Maya, bank transfer, remittance, or payment center
The collector’s name, number, account, email, or claimed company, if visible
The app permissions shown on your phone, especially contacts, camera, photos, microphone, SMS, or location

Keep original files where possible. Do not crop, edit, annotate, or filter the only copy. Create a separate folder in your phone or cloud storage, and name files clearly, such as “June 20 2026 text threat to employer” or “Collector message to sister.”

2. Secure your phone, accounts, and contacts

After preserving evidence, reduce further damage:

Revoke the loan app’s permissions to contacts, photos, camera, SMS, microphone, and location.
Change passwords for email, Facebook, Instagram, TikTok, Google, Apple ID, and e-wallet accounts.
Turn on two-factor authentication.
Make social media profiles temporarily private.
Tell close contacts not to engage with collectors or send money to anyone claiming to collect on your behalf.
Report fake accounts or posts directly to the platform for takedown.
Avoid giving more IDs, selfies, OTPs, passwords, private photos, or “verification videos” after threats begin.

A simple message to contacts may help control the damage:

An online lending app or collector may message you about me. Please do not reply, send money, or click links. Kindly screenshot the message with the sender’s number/profile, date, and time, then forward it to me for reporting.

3. Send a written complaint to the lending app or company

For data privacy complaints, the NPC generally requires proof that you first informed the respondent in writing and gave it a chance to act. The usual exhaustion requirement is that the respondent failed to act appropriately or failed to respond within 15 calendar days, although the NPC may waive this in serious or urgent cases. (National Privacy Commission)

Send your complaint by email, in-app support, official customer service channel, or any contact listed in the loan agreement, privacy policy, or app listing. Keep proof of sending.

You may write:

I am formally complaining about your collection conduct. Your collectors have threatened to contact and shame my contacts, and have used my personal data for collection outside legitimate purposes. I demand that you immediately stop contacting third parties who are not guarantors or co-makers, stop threatening to publish or disclose my personal data, identify the collector or collection agency involved, provide a clear statement of account, and give me your consumer assistance reference number and data protection contact. I reserve my right to report this matter to the SEC, NPC, NBI, PNP, and other proper authorities.

Do not admit false facts just to sound cooperative. Keep the message factual: dates, numbers used, screenshots, people contacted, and what was said.

4. File a complaint with the SEC through SEC iMessage

For unfair debt collection by a lending company, financing company, or its collectors, file with the SEC Financing and Lending Companies Department.

The SEC iMessage system is the SEC’s web-based platform for submitting complaints, automatically generating an electronic ticket, and tracking the status of the concern. Its user guide identifies “Complaints on Financing and Lending Companies” as a service under the Financing and Lending Companies Department. (imessage.sec.gov.ph)

Prepare the following before filing:

Requirement	What to Include
Your identity and contact details	Full name, mobile number, email, address
App and company details	App name, company name, website, developer, SEC registration or Certificate of Authority if known
Loan details	Date borrowed, amount received, amount demanded, due date, payments made
Collection details	Names, numbers, chat accounts, agency names, dates and times of harassment
Evidence	Screenshots, call logs, messages to contacts, posts, receipts, contract, privacy policy
Specific violations	Threats, insults, contacting non-guarantor contacts, public shaming, false legal threats, late-night calls
Requested action	Investigation, order to stop unfair collection, penalties, correction of records, proper accounting

In practical terms, your SEC complaint should read like a timeline. For example:

June 10, 2026: Borrowed ₱5,000; received ₱3,200 after deductions.
June 17, 2026: Collector demanded ₱7,500.
June 18, 2026, 7:15 a.m.: Collector threatened to message my employer.
June 18, 2026, 9:02 a.m.: My sister received a message calling me a scammer.
June 19, 2026: A fake Facebook post used my ID photo.

This is easier for investigators to understand than a long emotional narrative with no dates.

5. File a complaint with the National Privacy Commission

File with the NPC if the app or collector misused your personal data, accessed your contact list, used your ID photo or selfie to shame you, contacted people who were not guarantors, or processed your data beyond what was necessary for the loan.

The NPC formal complaint process requires a specific complaint format. The complainant may download the form, print and fill it out, have it notarized, and submit it to the NPC in person, by courier, or by scanned copy through email at complaints@privacy.gov.ph. (National Privacy Commission)

A strong NPC complaint usually includes:

A notarized complaint-assisted form or verified complaint
Your valid government ID
A clear statement of facts
Screenshots and supporting evidence
Proof that you informed the lending app or company in writing
Proof that the company failed to respond or failed to act properly within 15 calendar days, unless you are asking the NPC to treat the matter as urgent
Witness screenshots or affidavits from contacts who were messaged
A copy of the app’s privacy policy, if available
Screenshots of app permissions or phone settings showing access to contacts/photos

If you are abroad, you may need a representative in the Philippines. A representative will usually need a Special Power of Attorney. For sworn documents executed overseas, Philippine agencies or prosecutors may require notarization, consular acknowledgment, or apostille depending on where the document was signed and how it will be used. DFA rules on authentication and apostille are relevant when Philippine documents must be used abroad or foreign-executed documents must be recognized for Philippine proceedings. (Apostille Philippines)

6. Report blackmail, threats, fake accounts, or cybercrime to NBI or PNP

Report to the NBI Cybercrime Division or PNP Anti-Cybercrime Group if the conduct involves:

Threats to harm you or your family
Threats to publish private photos, videos, IDs, or edited images
Fake Facebook, TikTok, Instagram, or messaging accounts
Impersonation
Online defamation or “scammer” posts
Extortion or demands for money using threats
Identity theft
Hacking or unauthorized account access
Sexual threats or intimate-photo blackmail

Bring or prepare:

Valid ID
Your phone or device containing the original messages
Printed screenshots and digital copies
Links to fake profiles, public posts, or pages
Profile URLs, not just screenshots
Phone numbers, email addresses, usernames, and account names used
A written timeline
Names and contact details of witnesses
Loan documents and payment receipts
SEC/NPC complaint ticket numbers, if already filed

Cybercrime evidence can disappear quickly. Fake accounts may be deleted, numbers may be abandoned, and posts may be removed. Under the Cybercrime Prevention Act rules, traffic data and subscriber information are generally preserved for limited periods, and content data may require proper legal process. This is why complete URLs, screenshots, dates, times, and original device evidence matter. (Supreme Court E-Library)

7. Consider a police or barangay blotter for immediate safety concerns

A barangay or police blotter can help create a local incident record, especially if collectors threaten to visit your home, harass your household, or cause a scene at your workplace.

However, a barangay blotter is not a substitute for:

SEC reporting for unfair collection
NPC reporting for misuse of personal data
NBI or PNP cybercrime reporting for online threats, blackmail, impersonation, or cyberlibel

Barangay conciliation is generally designed for certain disputes between private parties, especially when they live in the same city or municipality. It is not the main remedy for cybercrime, data privacy violations, or SEC-regulated lending violations.

Evidence Checklist for Online Lending Harassment Complaints

Evidence	Why It Matters
Screenshots of threats	Shows the exact words used, date, time, number, and account
Messages sent to contacts	Proves third-party contact and possible data privacy violation
Call logs	Shows repeated calls, late-night calls, or harassment pattern
Public posts or fake accounts	Supports cyberlibel, identity theft, blackmail, or public shaming claims
Loan agreement and disclosure	Shows the lender, loan terms, charges, and payment schedule
Payment receipts	Shows amounts already paid and disputes over balance
App listing and developer details	Helps identify the operator behind the app
Privacy policy and app permissions	Shows what data the app claimed to collect and what it accessed
Written complaint to lender	Helps satisfy NPC exhaustion and shows you tried to resolve formally
Witness screenshots or affidavits	Strengthens claims that relatives, co-workers, or employers were contacted
Valid ID and contact details	Required for most formal complaints
SPA or authorization letter	Needed if someone else files or follows up for you

Timelines, Fees, and Practical Bottlenecks

There is no single guaranteed timeline for stopping online lending harassment. The speed depends on the strength of your evidence, whether the company is identifiable, whether the app is registered, and whether the conduct involves cybercrime or data privacy violations.

Process	Practical Timeline	Common Bottlenecks
SEC iMessage ticket	Ticket creation is usually immediate after submission	Incomplete company details, missing screenshots, anonymous collectors
SEC investigation or action	Often weeks to months	Unregistered apps, multiple related entities, outsourced collectors
NPC complaint preparation	Several days to weeks, depending on notarization and evidence	Missing proof of prior written complaint, no 15-day response period, incomplete form
Cybercrime reporting	Can be started immediately for urgent threats	Deleted accounts, lack of URLs, burner numbers, platform data delays
Platform takedown	Sometimes fast, sometimes inconsistent	Platform needs exact links and may not treat the issue as legal harassment
Barangay or police blotter	Same day in many cases	Limited usefulness for app-based harassment unless tied to safety threats

SEC MC No. 18 allows penalties for unfair collection. For lending companies, penalties under the circular include ₱25,000 for a first offense and ₱50,000 for a second offense. For financing companies, penalties include ₱50,000 for a first offense and ₱100,000 for a second offense. A third offense may lead to a fine of up to ₱1,000,000, suspension, or revocation depending on the circumstances.

Common Mistakes That Weaken a Complaint

Deleting the app before saving evidence

Uninstalling may remove messages, app details, transaction history, and privacy permissions. Preserve evidence first, then revoke permissions or uninstall.

Paying under pressure without documenting anything

Some borrowers pay because they are scared, then the collector continues demanding more. If you pay, save receipts and screenshots showing why you paid, how much was demanded, and who received it.

Posting the collector’s name or number publicly

It is understandable to feel angry, but public accusations can create unnecessary defamation or privacy issues. Send evidence to the proper agencies instead.

Reporting only to Facebook, Google Play, or the app store

Platform reports may help remove posts or apps, but they do not replace legal complaints with the SEC, NPC, NBI, or PNP.

Ignoring the underlying loan completely

A complaint about harassment does not automatically erase a valid debt. You can challenge abusive collection, illegal charges, misleading disclosures, or data misuse while still addressing the legitimate loan balance separately.

Believing every “legal threat” from a collector

Collectors often claim they will file estafa, send police, issue a warrant, or “blacklist” your whole family. Ordinary nonpayment of a loan is generally a civil collection matter. Criminal liability depends on specific facts, such as fraud from the beginning, falsified documents, identity theft, or other criminal acts. False threats of immediate arrest or fake legal action may themselves support a complaint for unfair collection or cybercrime-related conduct.

Not getting evidence from contacted relatives or co-workers

If the app messaged your mother, employer, customer, or friend, ask that person to screenshot the message with the sender, date, and time. Their evidence may be stronger than your own statement that “they contacted my contacts.”

Special Situations

The online lending app contacted my employer

Contacting an employer to shame you, pressure your employment, or disclose your loan is a serious issue. Save the message received by your employer, identify the sender, and include it in your SEC and NPC complaints.

Your employer is usually not a guarantor unless they separately agreed to be one. A company HR officer, supervisor, or co-worker does not become a proper collection contact simply because their number was stored in your phone.

The app messaged my family or friends

Under the DICT-NPC-SEC advisory and NPC rules, online lending platforms may not use a borrower’s contact list for debt collection except for properly named guarantors. Character references are not the same as guarantors. A person listed only as a reference should not be treated as someone responsible for paying your loan.

Ask each contacted person to send:

Screenshot of the message
Sender’s number, username, or profile link
Date and time received
Any follow-up threats
A short statement confirming they were not your guarantor or co-maker

The collector threatened to post intimate photos or videos

Treat intimate-photo threats as urgent. Save the messages and report to NBI or PNP cybercrime channels. Also report the account or post directly to the platform for takedown.

Do not send more photos, videos, passwords, OTPs, or money in exchange for a promise to delete the material. Blackmailers often continue demanding more.

The app is not registered with the SEC

Still report it. Lack of clear registration does not make the harassment “unreportable.” It may raise additional issues, such as unauthorized lending operations, misleading app identity, or cybercrime.

Include all identifying details you can find:

App name
Package name or developer name in the app store
Website
Privacy policy
Email address
Phone numbers
E-wallet or bank accounts used for payment
Company names appearing in messages or receipts

I am an OFW or foreigner outside the Philippines

You can start by filing online or by email where the agency allows it, especially for SEC iMessage and NPC submissions. If the case requires sworn affidavits, prosecution, or representation in the Philippines, you may need notarized documents, a Special Power of Attorney, or consular/apostilled documents depending on where you are and how the document will be used.

Foreigners may report if they are the borrower, data subject, victim, or affected person. It helps to show the Philippine connection, such as:

Philippine-based lending app or company
Philippine phone numbers or collectors
Philippine bank, e-wallet, or remittance transactions
Filipino contacts being harassed
Threats made while you were in the Philippines
Personal data processed by a Philippine entity or app targeting Philippine borrowers

Frequently Asked Questions

Can online lending apps message my contacts in the Philippines?

Generally, they should not message your contacts for debt collection unless the person is a properly named guarantor or co-maker. The 2026 DICT-NPC-SEC advisory says contacting people in a borrower’s contact list, other than named guarantors, for debt collection is prohibited.

Is online lending harassment a criminal case?

It can be, depending on the acts. Abusive collection may be an SEC administrative complaint. Misuse of contacts, photos, or personal data may be a data privacy complaint. Threats, blackmail, fake accounts, cyberlibel, identity theft, or intimate-photo threats may involve criminal or cybercrime complaints.

Should I report to the SEC or NPC first?

Report to the SEC if the main issue is unfair debt collection by a lending or financing company. Report to the NPC if the main issue is misuse of personal data, contact list access, ID photos, selfies, or privacy violations. If there are threats, blackmail, fake accounts, or cybercrime, report to NBI or PNP as well. Many serious cases require more than one report.

Can I report even if I really owe money?

Yes. A valid loan does not authorize harassment, public shaming, threats, blackmail, or misuse of your contacts. Your complaint should focus on the illegal or abusive collection conduct. The debt issue may still need to be resolved separately.

Can a loan app have me arrested for not paying?

Ordinary failure to pay a debt is generally a civil matter, not automatic grounds for arrest. A collector’s claim that police will immediately arrest you or that a warrant already exists is often a pressure tactic. Criminal issues may arise only if there are separate facts, such as fraud, identity theft, falsified documents, or other criminal conduct.

What if the collector says they will file estafa?

The word “estafa” is often used to scare borrowers. Nonpayment alone is not automatically estafa. Estafa requires specific elements, such as deceit or abuse of confidence. Save the threat and include it in your complaint if the collector uses fake criminal accusations to pressure you.

How do I stop them from posting my ID or selfie?

Preserve the threat, report the account or page to the platform, revoke app permissions, and file complaints with the NPC and SEC. If the post is already public or the threat is used to demand money, report to NBI or PNP cybercrime channels as well.

Can my relatives or co-workers also complain?

Yes, especially if they received messages, threats, or defamatory statements. They should preserve screenshots and may provide statements or affidavits. They may also have their own privacy or harassment concerns if their personal information was used without proper basis.

How long does it take for online lending harassment to stop?

Some collectors stop after a formal complaint, SEC ticket, NPC complaint, or cybercrime report. Others continue using new numbers. The practical timeline can range from days to months depending on the app, evidence, and agency action. Strong documentation usually improves the chances of meaningful action.

What if I already paid but they still harass me?

Save proof of payment and the continued demands. Ask for a statement of account and official receipt or confirmation. Continued harassment after payment may support your complaint, especially if the collector is demanding unauthorized penalties or refusing to acknowledge payment.

Key Takeaways

Online lending apps may collect valid debts, but they cannot use threats, blackmail, public shaming, or misuse of personal data.
Contacting your phone contacts for collection is prohibited except for properly named guarantors or co-makers.
Report unfair debt collection to the SEC, data misuse to the NPC, and threats or blackmail to NBI or PNP cybercrime authorities.
Preserve evidence before deleting messages, uninstalling the app, or blocking numbers.
A strong complaint includes a clear timeline, screenshots, app details, loan documents, payment receipts, and proof of messages sent to your contacts.
Paying under pressure does not automatically solve harassment; document all payments and demands.
Borrowers abroad, OFWs, and foreigners may still report Philippine online lending harassment, but sworn documents or representation may require notarization, consular acknowledgment, apostille, or a Special Power of Attorney.