Quick answer

If an online lending app threatens, insults, publicly shames, or contacts people who did not guarantee your loan, report the collection conduct to the Securities and Exchange Commission (SEC). If the app accessed, copied, disclosed, or misused personal data—such as contacts, photos, messages, or social-media information—complain to the National Privacy Commission (NPC). Serious threats, fraud, extortion, impersonation, or other possible crimes should also be reported to law enforcement.

One incident may justify reports to more than one agency. Preserve the evidence before blocking numbers, revoking permissions, or uninstalling the app.

Harassment does not automatically cancel a valid debt. However, a lender must use lawful, reasonable collection methods. The Constitution also prohibits imprisonment solely for debt; separate criminal liability is possible only when the facts independently establish an offense—not simply because a loan remains unpaid.

What lenders may—and may not—do

A lender may:

Send reasonable payment reminders and demand letters.
Ask for payment and discuss a lawful repayment arrangement.
Use a legitimate collection agency or lawyer.
File an appropriate civil case.
Contact a guarantor who expressly agreed to answer for the debt.

Those rights do not permit harassment, deception, public shaming, or indiscriminate use of personal data.

Unfair collection practices

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot legally be taken, such as inventing an arrest warrant or pretending that imprisonment automatically follows nonpayment.
Using abusive, obscene, insulting, or profane language when its natural consequence is to abuse the borrower and it amounts to an offense under applicable law.
Publishing or improperly disclosing a borrower’s name or personal information.
Communicating loan information known, or which should be known, to be false—including failing to say that a debt is disputed when relevant.
Using false representations or deceptive means to collect.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions for an account more than 15 days past due or the borrower’s express consent concerning convenient contact times.
Contacting people in the borrower’s contact list who were not named as guarantors or otherwise legally responsible for the loan.

The lending or financing company remains responsible for collection work outsourced to an agency, call center, law firm, or other service provider.

Privacy violations involving lending apps

The Data Privacy Act requires lawful, transparent, and proportionate processing of personal data. The current rules are detailed in NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02.

Possible violations include:

Requiring unnecessary permissions or collecting data excessive for the stated purpose.
Harvesting an entire contact list and using it to pressure or shame a borrower.
Contacting relatives, coworkers, employers, friends, or other contacts who were not guarantors.
Posting a borrower’s photo, ID, loan details, or accusations on social media or in group chats.
Altering a photo or creating a “wanted,” “scammer,” or similar shaming image.
Accessing photos, location, contacts, or other device resources after the legitimate purpose has ended.
Retaining personal data indefinitely without a lawful reason.
Refusing a valid request to explain the processing, identify recipients, correct inaccurate data, or erase or block unlawfully processed data.

Limited access to a contact list may be allowed so the borrower can select a character reference or consenting guarantor, or to derive proportionate metadata for a specified legitimate purpose. Unconstrained or excessive processing is prohibited. A character reference is not automatically a guarantor and generally may be contacted only to verify the borrower’s identity or information—not to collect the debt.

Camera or photo-gallery access may be justified for know-your-customer checks, identity verification, payment verification, or a comparable legitimate purpose. Access should end when that purpose is fulfilled, and the borrower’s photo cannot be used for harassment.

These rules apply even to an entity acting as a lender without the required SEC authority. The government reaffirmed these restrictions in its March 18, 2026 joint advisory on online lending platforms.

What to do immediately

1. Preserve the evidence

Before uninstalling the app or deleting anything, save:

Full screenshots and screen recordings of messages, call logs, posts, group chats, and app notifications.
The sender’s phone number, profile, account name, email address, and displayed company or collection-agency name.
Dates, times, exact words used, and the frequency of calls or messages.
The app’s store listing, developer name, privacy notice, permissions page, terms, and version number.
The loan agreement, disclosure statement, promissory note, repayment schedule, receipts, and account history.
Messages showing that you disputed the debt, requested a computation, or asked the lender to stop.
Copies of messages sent to your family, employer, coworkers, or other contacts.
Statements or affidavits from contacted persons, if they are willing.
Proof of harm, such as an employer’s notice, medical records, counseling expenses, or costs incurred because of the incident.

Keep original files and make a backup. Avoid relying only on cropped screenshots; preserve enough context to show the sender, date, conversation, and connection to the lender.

2. Secure your phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, camera, photos, location, microphone, and storage.
Change passwords for email, social media, banking, and e-wallet accounts if compromise is possible.
Enable two-factor authentication.
Tell affected contacts not to reply, send money, click links, or disclose more information.
Report abusive accounts, posts, and the app itself to the relevant platform or app store.
Do not pay a collector through an unfamiliar personal account without verifying the lender and obtaining an official receipt.

Revoking a permission may limit future access, but it cannot undo data already copied. A written demand and regulatory complaint may still be necessary.

3. Notify the lender or its data protection officer in writing

Identify the company behind the app—not only the app’s marketing name. Check the loan documents, privacy notice, receipts, and app-store developer details.

Send a written notice by a channel that produces proof of delivery. State:

Your name and account reference.
The app and company involved.
What happened, with dates and examples.
The numbers, accounts, employees, or collectors involved.
Which data was accessed, used, or disclosed.
That you dispute any inaccurate statements or computation, if applicable.
The action requested: stop contacting third parties, stop harassment, correct inaccurate data, identify recipients, restrict processing, or erase/block data where legally warranted.
A request for a written response and complaint reference number.

For an eventual NPC complaint, this step is especially important. As a general rule, the NPC will not give a complaint due course unless the complainant first informed the responsible entity in writing and the entity failed to take timely, appropriate action or did not respond within 15 calendar days. The NPC may waive this requirement for good cause or a serious violation involving risks such as grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct. The waiver is discretionary, so explain and document the urgency.

How to report unfair collection to the SEC

Beginning April 1, 2026, the SEC requires complaints to be filed through its iMessage portal.

Select Open a New Ticket.
Sign in through eSECURE or register if required.
Choose Complaints on Financing and Lending Companies under the Financing and Lending Companies Department.
Complete the complaint form accurately.
File one complaint form for each respondent company.
Attach a valid government-issued ID and supporting evidence.
Submit the ticket and save its number.
Monitor the ticket and promptly answer requests for additional documents.

Name the corporate lender, collection agency, and individual collector if known. If the app conceals the company’s identity, provide everything that may identify it: app-store page, developer name, payment destination, bank or e-wallet account, website, phone numbers, email addresses, screenshots, and loan documents.

The SEC may investigate and impose administrative sanctions, but it does not ordinarily rewrite payment terms, declare a contract or interest clause void, or cancel a loan through the complaint-assistance process. Contract validity, damages, and defenses to collection may require court proceedings and individual legal advice.

How to file a privacy complaint with the NPC

Who may complain

A borrower may complain about misuse of the borrower’s own personal data. A relative, coworker, character reference, or other person whose contact details or messages were improperly processed may file regarding that person’s own privacy rights.

A representative generally needs a special power of attorney. One complainant should not assume that they can assert every contacted person’s separate privacy claim without authority.

Required documents

Use the NPC’s Complaints-Assisted Form and filing guidance or prepare a verified complaint. Include:

The complainant’s identity and contact details.
The respondent’s identity and service address, if known.
A chronological statement of material facts.
The specific personal data and processing involved.
The relief requested.
Copies of evidence and relevant witness affidavits.
All correspondence with the lender and proof of its response—or lack of response within 15 calendar days.
A certification against forum shopping disclosing related cases or claims filed elsewhere.

The Complaints-Assisted Form must be completed and notarized; an independently prepared complaint must be signed and verified. Incomplete complaints may be dismissed outright.

Filing channels

The complaint may be filed personally, by registered mail, by courier, or by authorized email. Current NPC contact details are:

Email: complaints@privacy.gov.ph
Address: 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City
Telephone: (+63) 2 5322 1322, locals 114 or 115

For email filing, follow the NPC’s current format requirements. Electronic documents should be digitally signed and in PDF format when practicable. Keep the sent email, delivery confirmation, originals, and proof of payment.

Under NPC Circular No. 2023-01, the basic complaint filing fee is ₱500. Additional fees may apply to damages claims, applications for interim relief, printing, or other proceedings. Qualified indigent complainants may seek an exemption by submitting the required proof of indigency and financial qualification.

If continued processing presents grave and irreparable harm, ask about an application for a temporary ban or cease-and-desist order. Interim relief is not automatic and may require a separate application, supporting proof, fees, and a bond.

Do not delay unnecessarily. For penal violations of the Data Privacy Act, the NPC Rules adopt the varying prescriptive periods in Act No. 3326, which depend on the penalty for the particular offense. Civil, administrative, and other criminal remedies may follow different limitation periods.

When to report to law enforcement

Contact law enforcement promptly when the conduct includes:

A credible threat of physical harm, kidnapping, property damage, or violence.
Extortion or a demand for money accompanied by threats.
Impersonation of a police officer, court, prosecutor, or government agency.
Fabricated warrants, summonses, criminal charges, or court documents.
Account hacking, unauthorized access, identity theft, or fraudulent transactions.
Doxxing or coordinated online attacks that create an immediate safety risk.
A lending scam, such as demanding an advance “release,” “processing,” or “insurance” payment for a loan that was never disbursed.

The March 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph, (+632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph, onlinecims.ocs@gmail.com, (+632) 8723-0401 local 7491

The NBI’s citizen procedure for computer-crime victims contemplates a complaint form, sworn statements or affidavits, supporting documents, and—when relevant—examination of the device.

For immediate danger, call the nationwide Unified 911 Emergency Hotline or go to the nearest police station. Regulatory complaints to the SEC or NPC are not substitutes for emergency assistance or a criminal investigation.

If the lender is regulated by the BSP

The SEC route generally applies to lending and financing companies. If the creditor is a bank, digital bank, credit-card issuer, electronic-money issuer, pawnshop, or another institution supervised by the Bangko Sentral ng Pilipinas, first complain through the institution’s Financial Consumer Protection Assistance Mechanism.

If the institution’s response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism:

BSP Online Buddy or BOB through the BSP website
Email: consumeraffairs@bsp.gov.ph, using the BSP Complaints, Inquiries and Requests form
Direct line: (02) 5306-2584

The BSP’s rules also prohibit abusive collection practices by supervised institutions and their collection agencies.

Common mistakes that weaken a complaint

Uninstalling the app before recording its permissions, privacy notice, developer, and messages.
Submitting cropped or edited screenshots without dates, numbers, or context.
Naming only the app and not the company behind it.
Combining several unrelated lenders in one SEC complaint.
Failing to preserve the loan agreement, payment history, and disputed computation.
Filing an NPC complaint without first sending the required written notice or explaining why a waiver is justified.
Omitting related SEC, NPC, police, prosecutor, or court cases from the certification against forum shopping.
Exaggerating facts or identifying every payment reminder as harassment.
Posting unredacted IDs, loan documents, or contacts publicly while seeking help.
Assuming that reporting harassment automatically extinguishes the debt.
Continuing to communicate only by telephone, leaving no written record.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly when:

A collector has made a credible threat or released sensitive information.
Your employer, business, family safety, or mental health is being seriously affected.
You received an authentic summons, subpoena, court order, or prosecutor’s notice.
The lender is attempting foreclosure, repossession, garnishment, or another formal remedy.
You intend to claim substantial damages or seek an urgent injunction, temporary ban, or cease-and-desist order.
Several proceedings involve the same facts and the forum-shopping rules may apply.
The incident happened long ago and prescription may be an issue.

Do not ignore genuine court or government documents. Verify them directly with the issuing court or agency using independently obtained contact information—not a number supplied by the collector.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. The current NPC rules prohibit unbridled processing of contact lists and contacting people for debt collection outside the guarantors provided by the borrower. Limited access may be permitted to let you select a reference or guarantor, or to derive proportionate metadata for a specified legitimate purpose.

Is a character reference responsible for my debt?

Not automatically. A character reference is generally supplied to verify identity or information. A guarantor must expressly consent to answer for the debt in accordance with applicable law.

Does giving the app permission mean it may shame me or message my contacts?

No. Permission or consent is not unlimited. Processing must remain lawful, transparent, necessary, and proportionate. Deceptive interfaces, excessive access, harassment, and public shaming may still violate the law.

Can I file with both the SEC and NPC?

Yes, when the facts involve both unfair collection and misuse of personal data. Disclose related proceedings truthfully, particularly in the NPC certification against forum shopping, and keep the factual account consistent.

Can I complain if I am not the borrower?

Yes, if your own personal data or privacy rights were affected—for example, the app obtained your contact details and repeatedly messaged you even though you were not a guarantor. File based on the harm to you, not as an unauthorized representative of the borrower.

Will the complaint erase my loan?

No. A valid obligation generally remains collectible through lawful means. Disputes about whether a loan exists, how much is due, whether charges are enforceable, or whether a contract is void depend on the documents and facts and may require court action.

Can I be arrested simply for failing to pay?

The 1987 Constitution prohibits imprisonment for debt. A collector cannot create an arrest warrant. This does not prevent investigation or prosecution of a separate offense when its legal elements are independently present, nor does it prevent a lawful civil collection case.

Official references

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the loan documents, messages, parties, evidence, and surrounding facts. Official sources and filing channels were checked as of July 24, 2026.