Quick answer

Online lending apps may collect a legitimate debt, but they may not use harassment, intimidation, public shaming, false claims, unlawful threats, or excessive use of your contacts and other personal data.

After preserving the evidence:

Report unfair collection practices to the Securities and Exchange Commission (SEC) through SEC iMessage.
Report unauthorized or excessive processing of personal data to the National Privacy Commission (NPC). Ordinarily, first send the lender or its data protection officer a written complaint and allow up to 15 calendar days for an appropriate response.
If the lender is a bank, digital bank, e-wallet operator, or another BSP-supervised institution, complain first through its consumer-assistance mechanism, then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).
Report threats, fraud, identity misuse, blackmail, hacking, or other possible crimes promptly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or another proper law-enforcement office. Call 911 if anyone is in immediate danger.

These complaints address different violations and may be pursued separately. Reporting harassment does not automatically cancel a valid loan, interest, or payment obligation.

What conduct should be reported?

A collector may send lawful payment reminders, state the accurate balance, propose payment arrangements, and use reasonable legal remedies. Collection becomes potentially unlawful or reportable when it involves conduct such as:

Threatening violence, property damage, arrest, prosecution, or another action the collector cannot legally take
Using obscene, insulting, degrading, or abusive language
Threatening to publish—or actually publishing—the borrower’s name, photograph, identification document, loan information, or alleged delinquency
Posting “wanted” graphics, altered photographs, or accusations on social media
Sending debt messages to relatives, co-workers, employers, clients, social-media contacts, or everyone in the borrower’s phonebook
Falsely claiming to be a lawyer, police officer, court employee, government agency, or authorized process server
Sending fabricated summonses, warrants, case numbers, or court documents
Giving false information about the debt or concealing that the amount is disputed
Repeatedly contacting a borrower at unreasonable or deliberately inconvenient times
Accessing contacts, photographs, files, location data, social-media connections, or other device resources beyond what is necessary and lawful
Using a borrower’s photograph or personal data to shame, intimidate, or pressure payment
Treating a character reference as a guarantor without that person’s separate agreement
Continuing to contact third parties after being told that they are neither guarantors nor responsible for the debt

The SEC’s unfair-collection rules generally treat contact before 6:00 a.m. or after 10:00 p.m. as unreasonable, subject to limited exceptions stated in SEC Memorandum Circular No. 18, Series of 2019. The surrounding facts—including the frequency, language, purpose, and recipients of the communications—still matter.

The joint DICT-NPC-SEC Advisory on Online Lending Platforms dated 18 March 2026 expressly reiterates that contacting people in a borrower’s contact list for collection, other than a properly consenting guarantor, is prohibited.

A character reference is not automatically a guarantor

This distinction is important:

A character reference may be contacted only for legitimate identity or information-verification purposes. The lender must explain why the person was contacted and how the contact details were obtained. The reference may ask to have their data removed as a reference.
A guarantor must have separately consented to assume responsibility for the loan if the borrower defaults. Merely appearing in someone’s phonebook, answering a verification call, or being named as a reference does not by itself create a guaranty.

Online lending platforms must provide a way for borrowers to select references and guarantors rather than taking and using the entire contact list without restraint. The governing rules appear in NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02.

Preserve evidence before blocking, deleting, or uninstalling

Keep the clearest original evidence you can obtain. Regulators need to identify the lender, collector, conduct, recipients, and dates.

Preserve:

Screenshots showing the entire message, sender’s number or account, date, and time
Screen recordings that show the conversation in sequence
Original SMS, chat messages, emails, email headers, voice messages, and call logs
Social-media posts, profile URLs, usernames, comments, and the date each post was accessible
The app-store listing, developer name, app URL, package name, website, privacy notice, and displayed company name
Screenshots of every permission requested or granted to the app
The loan agreement, disclosure statement, repayment schedule, statements of account, receipts, and payment records
Your written dispute, complaint, or request to the lender and proof that it was delivered
Any response from the lender, data protection officer, or collection agency
Names and contact details of relatives, colleagues, or other people who received collection messages
Screenshots or statements supplied directly by those recipients
Evidence of resulting harm, such as an employer’s notice, medical consultation, lost business, account compromise, or expenses incurred

Keep unedited copies and back them up in a separate secure location. Create a simple chronology listing the date, sender, recipient, exact conduct, and corresponding file name.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Preserve existing voicemails, automatically generated records, and written communications instead.

Protect your phone and contacts

Once the evidence has been captured:

Revoke the app’s access to contacts, photographs, files, camera, microphone, and location unless a permission remains genuinely necessary.
Review permissions at the operating-system level, not only inside the app.
Change passwords if you reused a password or disclosed credentials.
Enable multi-factor authentication on email, social-media, banking, and e-wallet accounts.
Warn contacted relatives or colleagues not to click links, provide information, send money, or argue with collectors.
Block abusive numbers only after saving the evidence.
Uninstall the app after preserving its identifying details and relevant records.

Revoking permissions can prevent further device access, but it does not necessarily erase information already copied by the lender. Uninstalling the app also does not erase the loan or automatically delete the lender’s records.

Identify the correct company and regulator

Do not rely only on the app’s brand name. Check the loan contract, disclosure statement, privacy notice, payment instructions, and app-store developer details for:

The creditor’s complete legal name
SEC or BSP registration information
Certificate of authority or license details
Business address and official contact channels
The data protection officer’s contact details
The name of any collection agency or third-party service provider

An e-wallet or shopping app may merely display a loan issued by a separate bank, financing company, or lending company. Direct the complaint against the actual creditor and identify the platform and collector as additional parties involved.

The applicable regulator is usually:

Provider	Main financial regulator
Lending or financing company, including its online platform	SEC
Bank, digital bank, or other BSP-supervised institution	BSP
Cooperative offering credit	Cooperative Development Authority, except cooperative banks supervised by BSP
Any entity processing personal data	NPC for data-privacy compliance
Suspected crime committed online	PNP, NBI, prosecutors, or other proper law-enforcement authority

An unregistered or unidentified app should still be reported. The NPC loan-processing rules cover persons acting as lenders whether or not they obtained SEC authority, while the March 2026 government advisory covers recorded and unrecorded online lending platforms.

Step 1: Send a written complaint to the lender or data protection officer

A written notice creates evidence and ordinarily satisfies the NPC’s exhaustion requirement. Send it through the lender’s official support address and data protection officer, if available.

Include:

Your full name and account or loan reference number
The app’s name and the creditor’s legal name
A dated description of each act complained of
The numbers, accounts, and collection agency involved
The names or categories of third parties contacted
A statement identifying any amount or loan term you dispute
Selected evidence, with an index if there are many files
The action you want taken

You may request that the lender:

Stop harassment and third-party collection messages immediately
Stop unauthorized or excessive processing of contacts, photographs, and other data
Block or erase data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary
Identify the source, purpose, recipients, and processing history of your personal data
Correct inaccurate information and notify recipients of the correction
Identify the creditor, collector, collection agency, and responsible officers
Preserve relevant collection logs, account records, and communications
Provide a written investigation result and corrective action

Requesting erasure does not guarantee deletion of every record. A lender may retain data that remains necessary for the loan contract, regulatory compliance, fraud prevention, or the establishment, exercise, or defense of legal claims. It may not, however, use necessary account records as an excuse for unrelated harassment or indefinite, excessive processing.

Step 2: File an SEC complaint for unfair collection

For lending and financing companies, use SEC iMessage, the SEC’s current centralized platform for complaints and public requests.

Select:

Financing and Lending Companies Department → Legal and Enforcement Division → Complaints on Financing and Lending Companies

Prepare:

The required complaint form or information requested by the portal
A valid government-issued ID
One complaint for each respondent company
The loan contract, disclosure statement, payment records, and account history
Screenshots and other evidence of the collection conduct
The creditor’s legal name and the app or platform name
A concise chronology and the specific relief requested

The SEC’s complaint guidance for lending and financing companies states that incomplete complaints may be dismissed and that the respondent is ordinarily given 10 days from receipt to answer or comment.

The SEC can investigate regulatory violations and impose appropriate sanctions. Its complaint process generally cannot, by itself, rewrite payment terms, declare an interest provision void, invalidate the contract, or cancel the debt. Those issues may require a separate consumer-redress, adjudicatory, or court proceeding.

Step 3: File an NPC complaint for privacy violations

Under the 2021 NPC Rules of Procedure, an NPC complaint ordinarily receives due course only if you show that:

You informed the lender, data processor, or concerned entity in writing; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or conduct that is patently illegal. Explain and support the urgency instead of simply omitting the prior notice.

Use the official NPC complaint form and filing instructions. A formal complaint must generally be completed, signed, verified, and notarized. It must identify the parties, narrate the material facts, state the relief sought, attach evidence and prior correspondence, and include the required certification against forum shopping.

The NPC currently permits submission in person, by courier, or by scanning and emailing the completed documents to complaints@privacy.gov.ph. Filing fees may apply under the current schedule, although qualified indigent complainants and other exempt parties may seek exemption.

If you also reported the matter to the SEC, police, or another agency, disclose those proceedings accurately in the NPC complaint. Do not conceal another case involving the same issues.

Step 4: Escalate complaints involving a BSP-supervised provider

If the creditor is a bank, digital bank, or another BSP-supervised institution:

First file with the institution’s Financial Consumer Protection Assistance Mechanism.
Keep its reference number, response, and proof of submission.
If unresolved or handled inadequately, escalate through the BSP Consumer Assistance channels.

You may use the BSP Online Buddy or submit the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph, with proof that you first complained to the institution.

The Financial Products and Services Consumer Protection Act prohibits abusive collection or debt-recovery practices, protects client data, requires free internal complaint assistance, and makes regulated providers responsible for their representatives. A provider may also be solidarily liable with an accredited third-party service provider involved in debt collection.

Step 5: Report threats, fraud, and other possible crimes

Seek law-enforcement assistance promptly if the conduct involves:

A credible threat of physical harm
Blackmail or a demand for payment to prevent publication of private material
Identity theft or use of your identification to open accounts
Fake court documents, warrants, or government identities
Unauthorized access to an account, device, or computer system
Fraudulent payment instructions or diversion to a collector’s personal account
Stalking, repeated visits to your home or workplace, or threats against family members

The Cybercrime Prevention Act assigns cybercrime enforcement to the PNP and NBI. Whether conduct constitutes threats, coercion, libel, computer-related identity theft, illegal access, or another offense depends on the exact words, acts, intent, and evidence.

The March 2026 DICT-NPC-SEC advisory lists these reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

For an immediate threat to life or safety, call the nationwide Unified 911 Emergency Hotline or go to the nearest police station.

Early reporting can matter because accounts disappear, messages are deleted, and service-provider records are subject to preservation rules and legal processes.

Deadlines and timing to remember

NPC prior notice: Ordinarily allow up to 15 calendar days after the lender receives your written privacy complaint, unless it acts inadequately sooner or the NPC waives the requirement for a serious or urgent case.
SEC respondent’s comment: The SEC complaint guidance ordinarily gives the lender 10 days from receipt to answer.
FCPA claims: Actions under the Financial Products and Services Consumer Protection Act generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure, with an outside limit of ten years from the violation.
Other claims: Data-privacy offenses, civil actions, threats, defamation, and other possible crimes have different limitation and procedural rules. Do not assume the FCPA period applies to every remedy.

The current 2021 NPC Rules repealed the older NPC procedural rules. Avoid relying on outdated online instructions that still quote the former six-month or 30-day administrative complaint deadline.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence
Naming only the app brand and not the legal creditor
Sending cropped screenshots that omit the sender, date, or surrounding conversation
Filing a privacy complaint without first giving written notice—or without explaining why a waiver is justified
Claiming that every contact from a lender is harassment
Assuming prior app permission authorized unlimited use of contacts forever
Treating consent as the only possible lawful basis for processing
Demanding deletion of all records without recognizing lawful retention duties
Secretly recording private calls without considering the Anti-Wiretapping Act
Paying through a personal bank or e-wallet account supplied by an unverified collector
Hiding related complaints or court cases in the NPC certification against forum shopping
Assuming that blocking the collector or changing SIM cards resolves copied-data misuse
Ignoring legitimate court papers because earlier messages were fake

Verify any summons or court notice directly with the named court. A genuine complaint should not be ignored merely because the collector previously behaved unlawfully.

When legal help is urgent

Consult a Philippine lawyer promptly when:

Private photographs, identification documents, or sensitive records have been published
The lender is threatening immediate publication or widespread contact blasting
Police, prosecutors, or a court have contacted you
You received an authentic subpoena, summons, or complaint
The loan identity, amount, interest, or payment history is seriously disputed
The conduct caused job loss, substantial financial damage, physical harm, or a medical emergency
You want damages, an injunction, a temporary ban on data processing, or criminal charges
Several proceedings may involve the same parties and facts

Bring your chronology, original files, loan documents, payment records, and copies of every complaint already filed.

Frequently asked questions

Can I complain even if I really owe the money?

Yes. A valid debt does not authorize harassment, deception, public shaming, unlawful threats, or excessive processing of personal data. Continue addressing any legitimate payment obligation separately.

May the lender contact my family or employer?

Not merely because their details appear in your phone. For debt collection, the 2026 government advisory states that the lender may contact a properly consenting guarantor. A character reference may be contacted only for legitimate verification, not pressured to pay or used to shame the borrower.

Can a character reference be forced to pay?

Not solely because the person was listed as a reference. A guaranty requires separate consent and must satisfy applicable legal requirements. The relevant documents and circumstances should be reviewed if the lender claims otherwise.

Does revoking consent erase my loan records?

No. Withdrawal of consent does not erase the contract or prevent all processing. The lender may have another lawful basis to keep necessary records. You may still challenge data that was unlawfully obtained, used for an unauthorized purpose, excessive, inaccurate, or no longer necessary.

Should I stop paying while a complaint is pending?

A complaint does not automatically suspend the loan. Pay only through a verified official channel and keep receipts. If the amount or account is disputed, state the dispute in writing and obtain legal advice before withholding payment.

Can the SEC cancel the loan?

The SEC’s ordinary regulatory complaint process does not generally cancel a loan, rewrite payment terms, or declare a contract void. Those remedies may require a separate adjudicatory or court proceeding.

What if the app has disappeared or uses changing names and numbers?

Preserve the app-store page, package name, website, privacy notice, payment accounts, text messages, and loan documents. Report the known details to the SEC, NPC, and—where threats, fraud, or identity misuse are involved—law enforcement.

Must I wait 15 days when publication or threats are continuing?

Not necessarily. The NPC may waive prior exhaustion for good cause or a serious violation, including grave and irreparable harm or patently illegal conduct. Explain the urgency and attach evidence. Immediate safety threats should be reported to law enforcement without waiting.

Official references

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the contract, communications, parties, evidence, and relief requested. Laws, procedures, addresses, and filing channels were checked against official sources current as of 27 July 2026.