Quick answer

Report abusive collection and privacy misuse to the regulator that supervises the lender:

SEC: For most online lending and financing companies, file through the SEC iMessage portal under “Complaints on Financing and Lending Companies.”
National Privacy Commission (NPC): Report unauthorized access, use, retention, or disclosure of your contacts, photos, messages, or other personal data. Ordinarily, you must first complain to the lender in writing and allow up to 15 calendar days for an appropriate response.
Bangko Sentral ng Pilipinas (BSP): If the app belongs to a bank, digital bank, electronic-money issuer, or another BSP-supervised institution, complain first through the institution’s consumer-assistance channel, then escalate through the BSP Online Buddy or the BSP Consumer Assistance Mechanism.
Police or NBI: Immediately report credible threats of violence, extortion, impersonation, account compromise, or other possible crimes. Dial 911 if anyone is in immediate danger.

You may report the same incident to more than one agency because harassment, improper debt collection, privacy violations, and possible crimes involve different legal issues. Filing a complaint does not automatically erase a valid loan, but an unpaid balance does not give a lender permission to threaten, shame, deceive, or misuse personal data.

What conduct can be reported?

Under SEC Memorandum Circular No. 18, Series of 2019, financing companies, lending companies, and their collection agencies may use reasonable and lawful methods to collect amounts due. They may not engage in unfair practices such as:

threatening violence or other criminal acts against a person, reputation, or property;
threatening an action that cannot legally be taken;
using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
publishing or disclosing a borrower’s name or personal information to shame the borrower;
communicating false loan information, including concealing that a debt is disputed;
falsely claiming to be a lawyer, court officer, police officer, government employee, or representative of an agency;
using deceptive representations to collect money or obtain information;
contacting people in the borrower’s phone or social-media contact list who were not named as guarantors or co-makers; or
normally contacting the borrower before 6:00 a.m. or after 10:00 p.m.

The restriction on collection hours has exceptions under the SEC circular when the account has been past due for more than 15 days or the borrower expressly agreed—through written, electronic, or recorded means—that those hours are the only reasonable or convenient opportunity for contact. Even then, threats, insults, deception, public shaming, and improper disclosure remain prohibited.

The Financial Products and Services Consumer Protection Act also prohibits financial service providers from employing abusive collection or debt-recovery practices.

Contact-list and privacy violations

The Data Privacy Act of 2012 requires personal data to be processed lawfully, fairly, transparently, and only to the extent necessary for a legitimate purpose. Data subjects have rights that include being informed, obtaining access, disputing inaccuracies, objecting in appropriate cases, and seeking blocking, deletion, or destruction when legally justified.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

an app may process only data that is suitable, necessary, and not excessive for a lawful loan-related purpose;
permission to use the camera or photo gallery may be justified at a particular stage for identity verification, fraud prevention, or payment verification, but continued access must not be excessive;
a borrower’s photograph must not be used to harass or embarrass the borrower;
unrestrained or disproportionate harvesting of phone, email, or social-media contacts is prohibited;
contact-list processing that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors is prohibited;
an app may provide a limited interface through which the borrower chooses a character reference or guarantor; and
for debt collection, the lender may contact only a person who actually agreed to be a guarantor—not every character reference or contact saved on the borrower’s phone.

A character reference is not automatically a guarantor. A guarantor must expressly agree to answer for the borrower’s obligation in accordance with the law.

Accepting an app’s general terms or permissions does not automatically legalize excessive processing, public shaming, or contacting everyone in the borrower’s address book. Conversely, some processing may remain lawful for identity verification, fraud prevention, servicing the loan, regulatory compliance, or the establishment and defense of legal claims. Whether a particular act violates the law depends on what data was processed, the disclosed purpose, the applicable lawful basis, and how the data was actually used.

Act quickly, but preserve the evidence first

Before blocking numbers, deleting messages, revoking permissions, or uninstalling the app, preserve:

screenshots and screen recordings showing the full message, account name, phone number, date, and time;
original SMS, email, chat threads, voice messages, and call logs;
URLs and screenshots of public posts, comments, group messages, or edited photographs;
messages received by relatives, friends, co-workers, employers, or other contacts;
the app’s name, icon, developer, download-page URL, version, and requested permissions;
the lender’s corporate name, SEC registration or certificate details, office address, email address, and collection-agent identity;
the loan agreement, disclosure statement, payment schedule, receipts, account statement, and proof of payments;
the privacy notice and terms displayed when you applied, especially statements about contacts, photos, location, and collection;
your written complaint to the lender and proof that it was received; and
evidence of actual harm, such as an employer’s notice, medical or counseling records, security expenses, fraudulent transactions, or witness statements.

Keep unedited originals. Back them up to a secure device or account and prepare a chronological incident log. Ask recipients to preserve what they personally received and, if necessary, provide an affidavit.

Do not secretly record a private call without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. You may preserve a voicemail or audio file that the collector sent to you, and you may make contemporaneous written notes stating the date, time, number, participants, and words used.

After preserving evidence, review and revoke unnecessary permissions for contacts, photos, files, camera, microphone, location, call logs, or SMS. Uninstalling the app may stop future device access, but it will not necessarily delete information already copied by the lender, terminate the loan, or close the account.

Send the lender a written complaint

For privacy complaints, the NPC ordinarily requires you to give the lender or other responsible entity an opportunity to address the violation. Send the complaint to the company’s official customer-service channel and, if available, its data protection officer.

State:

your name and account or loan reference number;
the app and corporate entity involved;
each incident, with dates, times, numbers, and recipients;
the personal data accessed, copied, disclosed, or misused;
whether the debt or amount is disputed;
the action you want; and
a deadline for acknowledgment and an appropriate response.

You may request that the company:

stop threats, insults, deceptive claims, and third-party shaming;
stop contacting anyone who is not a valid guarantor;
identify the collection agency and persons who processed your data;
explain its lawful basis and source for each category of personal data;
preserve relevant logs, recordings, instructions, and account records;
correct inaccurate loan or personal information;
block or delete unlawfully processed data, subject to lawful retention requirements;
provide a complete statement of account and payment history; and
confirm its corrective action in writing.

Keep delivery receipts, email headers, ticket numbers, and screenshots showing that the complaint was received. Do not send passwords, one-time PINs, card security codes, or unrelated identity documents.

How to file with the SEC

Most non-bank lending and financing companies fall under SEC supervision under the Lending Company Regulation Act of 2007 and related laws.

Go to the SEC iMessage portal and select Open a New Ticket.
Sign in through an eSECURE account.
Select Complaints on Financing and Lending Companies under the Financing and Lending Companies Department.
Identify both the app name and the company operating it. If the collector gave another company name, identify that collection agency as well.
Describe the prohibited conduct factually and in chronological order.
Attach readable copies of your evidence.
Save the unique ticket number and monitor the conversation thread for requests or compliance instructions.

The SEC’s current iMessage user guide describes iMessage as its centralized system for complaints and allows users to track tickets and upload additional files.

Do not file an investment-scam complaint when the issue is abusive loan collection; choose the financing-and-lending-company complaint service so it reaches the proper department.

How to file a privacy complaint with the NPC

1. Complete the exhaustion requirement

As a general rule, you must prove that:

you informed the lender, collection agency, or other responsible entity in writing about the privacy violation; and
it failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your written notice.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. Explain and prove the urgent circumstances if you request a waiver.

2. Prepare a verified complaint

Use the NPC’s Complaint-Affidavit form. A formal complaint should:

be written, signed, verified, and notarized;
identify the complainant and respondent—or provide facts that may lead to the respondent’s identity;
state the material facts and the specific personal data involved;
attach documentary evidence and witness affidavits, if any;
include all correspondence with the respondent;
state the relief requested;
include a certification against forum shopping; and
include a valid government-issued ID and any required authority if filed by a representative.

Incomplete complaints or allegations unsupported by sufficient information may be dismissed without prejudice.

3. Submit and pay the applicable fee

The NPC’s formal-complaint page permits submission in person, by courier, or by scanning and emailing the notarized complaint to complaints@privacy.gov.ph. Its current listed office is at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103.

Under the NPC’s published schedule of fees, the basic complaint filing fee is ₱500, plus a legal-research fee of 1% of the filing fee but not less than ₱10. Additional fees apply when claiming damages. Qualified indigent complainants may seek exemption by submitting the required proof. Confirm the current assessment and payment instructions with the NPC before paying.

The NPC may order compliance, impose administrative fines, award indemnity on data-protection matters where supported by law and evidence, prohibit processing, or recommend prosecution to the Department of Justice. A particular remedy or outcome is never automatic.

When the lender is BSP-supervised

An app operated by a bank, digital bank, non-bank electronic-money issuer, money-service business, pawnshop, or another BSP-supervised institution follows the BSP consumer-redress process.

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.
Keep the complaint reference number and the institution’s response.
If unresolved or unsatisfactory, escalate through the BSP Online Buddy on the BSP website or the BSP’s official Facebook page.
If you cannot use the chatbot, complete the BSP Complaint, Inquiry, and Reply form and email it, with proof of your first-level complaint, to consumeraffairs@bsp.gov.ph.

The BSP’s official complaint guidance identifies the institution’s internal mechanism as the required first-level recourse. The BSP consumer-assistance page lists the available escalation channels.

If you are unsure which regulator supervises the lender, ask the SEC or BSP to confirm. An app-store listing or brand name alone may not identify the actual licensed entity.

When to involve law enforcement

Go to the nearest police station or seek assistance from the NBI when the evidence suggests a crime—for example:

a credible death threat or threat of physical harm;
extortion or a demand for money accompanied by unlawful threats;
impersonation of police, courts, lawyers, or government agencies;
hacking, account takeover, identity theft, or fraudulent use of your information;
stalking or publication of manipulated, intimate, or humiliating material; or
continued conduct creating an immediate safety risk.

For computer-related incidents, the NBI Cybercrime Division accepts complaints and supporting evidence. The NBI’s citizen procedure for computer-crime victims explains that complainants and witnesses may be asked to execute sworn statements and present relevant devices and documents.

Call the national Unified 911 hotline if a threat appears imminent. Do not meet a threatening collector alone, send money to an unfamiliar personal account, or click a link sent as part of a threat.

What harassment does—and does not—change about the debt

Harassment does not make unlawful collection methods acceptable, even when the loan is overdue. It also does not automatically cancel a valid principal balance or prevent the lender from using lawful collection methods, reporting authorized credit information, or filing a proper civil case.

The Constitution states that no person may be imprisoned merely for debt. A collector cannot lawfully order your arrest or issue a warrant. Only a court or authorized public officer acting through proper legal process can issue compulsory legal orders. However, separate facts—such as proven fraud or another independently defined offense—may create criminal exposure. Do not ignore genuine court papers; verify them directly with the named court and seek legal help promptly. See Article III, Section 20 of the Constitution.

If you dispute the amount, say so in writing and request:

the signed or accepted loan agreement;
the disclosure statement;
an itemized computation of principal, interest, fees, penalties, and payments;
the identity and authority of any assignee or collection agency; and
a correction of inaccurate records.

Continue paying only through a verified official channel. Do not treat a collector’s personal e-wallet or bank account as legitimate without confirmation from the lender.

Common mistakes to avoid

Deleting the app or messages before preserving evidence.
Naming only the app. Include the corporate lender, developer, collection agency, phone numbers, and responsible officers if known.
Sending a vague complaint. Use dates, exact conduct, recipients, affected data, and supporting files.
Skipping the written complaint to the lender before filing with the NPC without explaining grounds for a waiver.
Assuming every contact-list permission is automatically illegal. The legal issue is whether access and processing were necessary, proportionate, disclosed, supported by a lawful basis, and used only for a legitimate purpose.
Assuming a character reference must pay. A reference is not a guarantor unless that person expressly undertook the obligation.
Secretly recording calls. Preserve sent voice messages and keep detailed notes; obtain legal advice before recording a private conversation.
Posting your evidence publicly. Redact IDs, addresses, loan numbers, children’s information, and other people’s data.
Ignoring authentic notices from a court or regulator. Verify them independently and observe stated deadlines.
Paying a “processing,” “case cancellation,” or “warrant removal” fee to a collector. Verify any demand directly with the lender and the supposed government office.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if eligible, or another qualified legal-aid provider promptly when:

there is a credible threat to life, safety, employment, or housing;
intimate images, identity documents, or financial credentials were disclosed;
several lenders or collection agencies are involved;
a court summons, subpoena, or prosecutor’s notice has been received;
the collector is demanding payment through extortion or impersonation;
you want damages, a temporary ban on data processing, an injunction, or criminal charges; or
you are unsure whether filing in several forums could create procedural issues.

Frequently asked questions

Can I complain even if I really owe the money?

Yes. A lender may pursue a valid debt only through lawful and reasonable methods. The complaint concerns how the debt was collected or how personal data was processed, not merely whether a balance exists.

Can the app message everyone in my contacts because I accepted its permissions?

Not for debt collection. Under the amended NPC rules, collection contacts are limited to actual guarantors. Broad contact harvesting, harassment, and contacting other people to pressure or shame the borrower are prohibited.

Can the lender contact my character reference about payment?

A character reference may be contacted to verify the borrower’s identity and the truth of application information. The reference is not automatically a guarantor and should not be treated as responsible for the debt. For collection, the lender may contact a person who separately and expressly agreed to be a guarantor.

Can I file if I am the friend, relative, or co-worker who was contacted?

Yes, if your own personal data was processed or you were affected by the privacy violation. Preserve the message and explain how the collector obtained or used your information. You may also support the borrower’s complaint as a witness.

Should I report the app to Google or Apple?

You may report the listing after preserving its name, developer, URL, permissions, and screenshots. An app-store report may help address platform-rule violations, but it does not replace an SEC, NPC, BSP, or law-enforcement complaint.

Will the regulator negotiate my payment terms?

Not necessarily. A harassment or privacy complaint is different from negotiating a restructuring or settlement. Ask the lender separately for an affordable written arrangement, without admitting a disputed amount.

Is there one deadline for every complaint?

No. Administrative, civil, and criminal remedies can have different filing or prescriptive periods, and the correct period depends on the violation and remedy. File promptly. The clearest procedural period at the initial NPC stage is the lender’s 15-calendar-day opportunity to respond to the written privacy complaint, subject to the NPC’s exceptions.

Official sources

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the loan documents, communications, identities of the parties, evidence, and applicable regulator. Official sources and procedures were checked on 24 July 2026.