Quick answer

Report harassment by an online lending app to the Securities and Exchange Commission (SEC). Report unlawful access, use, or disclosure of personal data to the National Privacy Commission (NPC). If there are threats, extortion, impersonation, fraud, account compromise, or danger to you or your family, also report immediately to law enforcement.

Being late on a loan does not give a lender or collector the right to threaten, insult, publicly shame, deceive, or contact people in your phonebook who are not guarantors. A privacy or harassment complaint does not automatically erase a valid debt, stop lawful collection, or cancel agreed charges. Keep the debt dispute or repayment discussion separate from the abusive conduct.

Conduct you can report

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing companies, lending companies, and their collection agents from using unfair collection practices. Report conduct such as:

Threatening violence, property damage, arrest, or another action the collector cannot legally take.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publicly disclosing the borrower’s name, loan, alleged default, photograph, identification documents, or other personal information without a lawful basis.
Giving relatives, employers, co-workers, or other people false information about the loan or failing to disclose that the debt is disputed.
Pretending to be a police officer, court employee, lawyer, government agency, or another person in authority.
Using false or deceptive means to collect or obtain information.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m. The circular provides exceptions when the account is more than 15 days past due or the borrower expressly agreed—through written, electronic, or recorded means—that those hours are the only reasonable or convenient times. Even then, threats, shaming, deception, and other abusive conduct remain prohibited.
Contacting people in the borrower’s contact list for debt collection when they are not guarantors.

A collection agency or freelance collector does not shield the lender from responsibility. Under the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, financial service providers are responsible for their representatives and may be solidarily liable with accredited third-party service providers involved in debt collection.

Character references are not automatically guarantors

A character reference may be contacted only for identity or information verification. The reference must be told how the lender obtained the contact details and must be allowed to request removal as a reference.

A guarantor is different: the person must separately and expressly consent to assume responsibility if the borrower defaults. The app cannot turn a character reference—or anyone merely found in the borrower’s phonebook—into a guarantor. For debt collection, current NPC rules permit contact with the guarantor, not unrelated contacts. These rules appear in NPC Circular No. 2022-02 and were reiterated in the government’s 18 March 2026 advisory on online lending platforms.

When collection becomes a privacy violation

The Data Privacy Act of 2012, Republic Act No. 10173 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate to that purpose. Possible violations include:

Copying or harvesting an entire contact list for collection or harassment.
Messaging contacts who were not selected as guarantors.
Posting a borrower’s photograph, ID, address, loan details, or fabricated “wanted” notice.
Sending loan information to an employer, group chat, social-media contact, or family member without lawful authority.
Using a borrower’s photograph to embarrass or pressure them.
Accessing the camera, photo gallery, location, storage, contacts, or other phone resources when unnecessary or excessive.
Keeping app permissions active after their stated purpose has been completed.
Using personal data for an undisclosed purpose or sharing it with unauthorized parties.
Refusing to explain what data was collected, where it came from, how it was used, or with whom it was shared.

Limited access may be lawful when genuinely necessary—for example, temporary camera or gallery access for identity verification, know-your-customer checks, fraud prevention, or payment verification. Contact-list access may also be used in a limited and proportionate way to let the borrower select a reference or guarantor or to derive necessary proportional metadata. Unrestricted copying, storage, disclosure, or use for harassment is prohibited.

Revoking app permissions helps prevent further access to the phone, but it does not necessarily delete information already copied. Likewise, the right to erasure is not absolute: a lender may retain data needed to administer an outstanding loan, comply with law, or establish, exercise, or defend legal claims.

What to do immediately

1. Preserve the evidence before blocking or uninstalling the app

Keep the original evidence wherever possible:

Full, uncropped screenshots showing the message, sender, phone number or account, date, and time.
The complete message thread, email headers, call logs, voicemail, and received audio or video files.
Screenshots of public posts, group chats, altered photographs, comments, and the page or profile URL.
The app name, app version, developer name, store listing, privacy notice, permissions screen, loan agreement, disclosure statement, repayment schedule, and receipts.
The corporate lender’s name, collection agency, collector’s claimed identity, payment account, and every phone number or social-media account used.
Copies of messages received by relatives, friends, employers, or co-workers.
A chronological incident log stating what happened, when, who received it, and what personal information was disclosed.
Proof of your written complaint to the lender and its response, delivery receipt, ticket number, or read confirmation.

Ask contacted people to preserve their original messages. If necessary, obtain signed affidavits describing what they received and when.

Do not secretly record a private call without legal advice and the authorization required by the Anti-Wiretapping Act, Republic Act No. 4200. Saving a voicemail or recording the collector voluntarily sent is different from secretly recording a live private conversation.

2. Identify the company behind the app

The app’s brand name may differ from the lender’s registered corporate name. Check:

The loan agreement and disclosure statement.
The app’s privacy notice, terms, “About” page, and developer information.
SEC registration and authority through Check with SEC.
The name on payment instructions and receipts.

Record both the app name and corporate name. If you cannot identify the operator, say so in the complaint and attach the available app-store, payment, telephone, and account details.

3. Secure your phone and accounts

After preserving evidence:

Revoke unnecessary permissions for contacts, photos, camera, microphone, location, files, SMS, and call logs.
Change passwords for email, social media, banking, and e-wallet accounts if compromise is possible.
Enable multi-factor authentication and sign out unfamiliar sessions.
Warn affected contacts not to click links, provide OTPs, send identification, or pay anyone claiming to collect for you.
Report impersonating accounts and unlawful posts to the platform, but preserve evidence first.
Do not pay a collector’s personal bank or e-wallet account unless the lender independently confirms that it is an authorized payment channel.

4. Send a written complaint to the lender and its data protection officer

Use the lender’s official customer-assistance channel and the data protection officer’s address stated in its privacy notice. Keep the complaint factual and concise. Include:

Your name and loan or account reference, with sensitive numbers partly masked where appropriate.
The app and corporate lender’s names.
The collector or agency’s details.
A dated description of each incident.
The people contacted and the data disclosed.
Copies of supporting evidence.
Whether you dispute the debt, amount, fees, or payment posting.
The action you want taken.

You may demand that the lender:

Stop threats, shaming, deception, and contact with non-guarantors.
Preserve all collection records, call logs, instructions, and data-access records.
Identify the collector and third-party service providers involved.
Explain the source, purpose, lawful basis, recipients, and retention period for your data.
Correct inaccurate information.
Remove unlawfully obtained contact data and stop unauthorized disclosure.
Confirm the correct balance and authorized payment channels.
Give a written response.

For an eventual NPC complaint, expressly identify the conduct as a privacy violation and retain proof that the lender received your written notice.

How to file with the SEC

For a lending or financing company and its online platform:

Open a ticket through the SEC iMessage portal.
Direct the complaint to the Financing and Lending Companies Department (FINLEND).
Identify the corporate lender, app, collector, loan reference, and dates.
Describe the prohibited conduct in chronological order.
Attach the loan documents, screenshots, call logs, messages to third parties, payment records, and your written complaint to the company.
Save the SEC ticket number and check its status through the same portal.

The SEC’s 2026 advisory also lists hotline 1-4732 (1-4SEC). Use official SEC channels rather than social-media accounts claiming to “process” complaints for a fee.

SEC enforcement may include fines, suspension, or revocation of authority to operate. Under SEC Memorandum Circular No. 18, a third violation may, depending on the facts, circumstances, and gravity, lead to a fine of up to ₱1 million, a 60-day suspension of lending or financing activities, or revocation. Sanctions are imposed only after the applicable proceedings; filing a complaint does not guarantee a particular outcome.

The applicable circular is linked in the SEC’s official financing and lending issuances index.

How to file a privacy complaint with the NPC

First notify the lender in writing

Under the 2021 NPC Rules of Procedure, as amended, the NPC ordinarily will not give a complaint due course unless:

You first informed the personal information controller, processor, or concerned entity of the violation in writing; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive these requirements for proven good cause or a serious violation—for example, grave and irreparable harm requiring NPC action, the absence of an adequate remedy from the respondent, or patently illegal conduct. Explain and document why immediate action is necessary rather than simply omitting the prior-notice step.

Prepare the formal complaint

Use the NPC’s current Complaint-Affidavit form. Complete it accurately and attach:

A valid government-issued ID.
Evidence of the personal data processed or disclosed.
A clear chronological narration.
Correspondence with the lender and proof of receipt.
The lender’s response, if any.
Screenshots, messages, URLs, app permissions, privacy notices, and witness affidavits.
The relief requested.
The required verification and certification against forum shopping.

The complaint must be notarized. Missing evidence, incomplete allegations, lack of verification, or failure to address exhaustion of remedies can result in outright dismissal.

Submit and pay only through official instructions

The NPC’s formal complaint page permits submission in person, by courier, or by sending a scanned notarized complaint to complaints@privacy.gov.ph. Check the NPC contact page before an in-person or courier filing because office arrangements may change.

The published filing fee is ₱500, with additional fees possible when damages or special relief are requested. Wait for the NPC’s official assessment and payment instructions.

Indigent litigants may be exempt if both conditions in the current fee schedule are met:

Their gross income, together with that of their immediate family, does not exceed twice the applicable monthly minimum wage; and
They do not own real property with a fair market value exceeding ₱300,000.

The exemption requires supporting documents, including a barangay certificate of indigency and the prescribed notarized affidavits. Consult the NPC schedule of fees for the complete requirements.

A relative, friend, or colleague whose own contact details or messages were unlawfully processed may file a separate NPC complaint as an affected data subject. They may also provide evidence for the borrower’s complaint.

When to report to the BSP

If the actual lender is a bank, digital bank, financing institution, e-money issuer, or another Bangko Sentral-supervised institution, first use the institution’s free Financial Consumer Protection Assistance Mechanism.

If the response is unsatisfactory, escalate through the BSP Online Buddy chatbot on the BSP website or the BSP’s official Facebook page. Continue until you receive a reference number. If you cannot access the chatbot, submit the BSP Complaint/Inquiry/Reply form and proof that you first used the institution’s complaint mechanism to consumeraffairs@bsp.gov.ph.

The current procedure is summarized in the BSP’s official complaint guide. A company incorporated with the SEC is not necessarily SEC-regulated for the particular financial service, so identify the regulator stated in the lender’s documents.

When police or cybercrime help is urgent

Do not wait for the lender’s internal process if there is:

A credible threat of physical harm, kidnapping, property damage, or stalking.
Extortion or a demand to pay to prevent publication of personal or intimate material.
Impersonation of police officers, courts, lawyers, or government agencies.
Hacking, account takeover, identity theft, or unauthorized financial transactions.
Publication of your home address or other information creating immediate danger.
A fraudulent loan you never applied for.
Evidence that may disappear quickly.

For immediate danger, call 911 or go to the nearest police station. The government’s March 2026 advisory lists these additional reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Bring printed and electronic copies of the evidence, identification, the device receiving the messages when practical, and a clear incident timeline. Ask for the complaint, blotter, or reference number.

Whether particular conduct constitutes grave threats, extortion, cyber libel, identity theft, unlawful disclosure, or another offense depends on the exact words, acts, intent, evidence, and applicable law. Let investigators and qualified counsel assess the proper charge.

What harassment does—and does not—change about the loan

The Constitution states that no person may be imprisoned merely for debt. A collector therefore cannot lawfully have a borrower arrested simply because an ordinary loan remains unpaid. Separate criminal conduct, such as proven fraud, is different and must be handled through proper legal proceedings—not through a collector’s threats.

Reporting harassment does not by itself:

Cancel the loan.
Prove that every interest or fee is invalid.
Stop a lawful civil collection case.
Authorize the borrower to ignore genuine court papers.
Require the deletion of records that must lawfully be retained.

Continue communicating through the lender’s verified official channel. If you dispute the balance, request an itemized statement and identify the exact amount, charge, payment, or term disputed. Do not ignore a genuine summons, subpoena, or court order; verify it directly with the named court and obtain legal advice promptly.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Naming only the app and omitting the corporate lender and collection agency.
Submitting cropped screenshots with no sender, date, or context.
Filing an NPC complaint without first sending written notice or explaining why the requirement should be waived.
Omitting notarization, identification, evidence, or the certification against forum shopping.
Posting the collector’s personal data publicly and creating a separate privacy or defamation issue.
Secretly recording private calls without checking the Anti-Wiretapping Act.
Paying an unverified personal account because of a threat or artificial deadline.
Sharing an OTP, password, selfie with ID, or full bank details with an unknown collector.
Assuming that agreeing to app permissions authorized public shaming or unlimited use of contacts.
Assuming that filing a complaint automatically cancels a valid obligation.

Frequently asked questions

Can a lender message my family or employer?

For debt collection, current NPC rules prohibit contacting people in your contact list who are not guarantors. A character reference is not automatically a guarantor and may be contacted only for verification, not to pressure payment. A lawful disclosure under a specific legal exception must still comply with data-privacy principles.

What if I gave the app access to my contacts?

Permission does not authorize unrestricted copying, storage, disclosure, or harassment. Processing must still be necessary, proportionate, transparent, and supported by a lawful basis. Revoke unnecessary permissions after preserving evidence.

Can I complain even if the debt is real and overdue?

Yes. The validity of the debt and the legality of the collection method are separate issues. A lender may use reasonable, lawful means to collect, but default does not legalize threats, insults, deception, public shaming, or unlawful data processing.

Can a contacted relative or friend complain?

Yes, if that person’s own contact details or other personal data were unlawfully processed. They may file their own NPC complaint and provide evidence supporting the borrower’s SEC complaint.

Should I block the collector?

Preserve the evidence first. Blocking may reduce distress, but keep at least one secure written channel open with the corporate lender so that legitimate account notices, responses, or settlement proposals can be received.

Is there a filing deadline?

For an NPC complaint, the immediate procedural issue is the prior written notice and ordinary 15-calendar-day response period. Other civil, administrative, and criminal remedies have different prescriptive periods.

Claims under Republic Act No. 11765 generally prescribe five years after the financial transaction was consummated or five years after discovery of deceit or nondisclosure of material facts, subject to an overall ten-year limit from the violation. Other causes of action may have shorter periods. Preserve evidence and seek help promptly rather than relying on the longest possible deadline.

Where can I get legal help?

Seek a Philippine lawyer, the Public Attorney’s Office if you qualify, or a recognized legal-aid office when there are court papers, significant financial claims, continuing disclosure, threats, identity theft, or uncertainty about recording and preserving evidence.

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. Application of the law depends on the documents, parties, regulator, evidence, and specific conduct. Official sources and procedures were checked as of 24 July 2026.