Quick answer

If an online lending app threatens, insults, publicly shames, impersonates authorities, misuses your photo, or contacts people who are not your guarantors to pressure you, preserve the evidence and report the conduct to the proper agencies:

Report abusive collection by a lending or financing company to the Securities and Exchange Commission (SEC).
Report unauthorized access, use, or disclosure of personal data to the National Privacy Commission (NPC).
Report credible threats, extortion, identity theft, account compromise, or other possible crimes immediately to the police or the National Bureau of Investigation (NBI).
If the provider is a bank, e-money issuer, pawnshop, payment operator, or another BSP-supervised institution, use the Bangko Sentral ng Pilipinas (BSP) complaint process instead of the SEC route.

These remedies can overlap. An SEC complaint does not replace an NPC complaint or a criminal report.

Harassment does not automatically cancel a valid debt, but owing money does not authorize abuse. The Financial Products and Services Consumer Protection Act prohibits abusive collection or debt-recovery practices, while the 1987 Constitution provides that no person may be imprisoned merely for debt.

What collectors are allowed to do

A lender may use reasonable and legally permissible means to collect an amount that is actually due. It may send proper payment reminders, demand payment, offer restructuring, assign an authorized collection agency, or pursue an appropriate civil remedy.

The lender and collector must still act in good faith, accurately identify the account and amount claimed, respect privacy, and avoid abusive or deceptive conduct. A lender generally remains accountable for collection work outsourced to a third-party service provider.

If you dispute the balance, ask through the lender’s official channel for:

The lender’s complete corporate name and SEC registration details
The collector’s identity and authority to act
A copy of the loan agreement and disclosure statement
A complete statement of account
An itemized computation of principal, interest, penalties, and fees
Official payment instructions
The lender’s privacy notice and data-protection contact details

Do not rely solely on a collector’s personal account, private messaging profile, or payment instructions that cannot be confirmed through the lender’s official website or application.

Conduct that may be unlawful

The SEC’s Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by financing and lending companies. Depending on the evidence and surrounding facts, report conduct such as:

Threatening violence, property damage, reputational harm, or another criminal act
Threatening an action that cannot legally be taken
Falsely claiming that an arrest warrant, criminal case, court order, or government action already exists
Pretending to be a police officer, court employee, lawyer, government agency, or another person
Using obscene, insulting, degrading, or profane language as intimidation
Publicly posting or circulating the borrower’s name, photo, loan information, identification document, or alleged delinquency to shame the borrower
Sending “wanted,” “scammer,” “estafa,” or similar posters to relatives, employers, coworkers, social-media contacts, or group chats
Using the borrower’s photo to embarrass or pressure the borrower
Contacting unrelated people from the borrower’s phonebook for debt collection
Using false or deceptive representations to obtain payment
Continuing a coordinated pattern of calls or messages in a way that becomes threatening, humiliating, or abusive

A payment reminder is not automatically harassment merely because it is unwelcome. The content, frequency, recipients, timing, threats, false statements, and use of personal data all matter.

Privacy rules for contacts, photos, and app permissions

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality.

The NPC’s loan-specific rules apply to lending and financing companies, their service providers, and even persons acting as lenders without the required SEC authority. Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

An app must not demand unnecessary or excessive permissions.
Access to a camera, photo gallery, contact list, or another protected resource must be suitable, necessary, and proportionate to a lawful purpose.
Permissions should be requested when the information is actually needed, with an understandable notice explaining how it will be used.
Camera or gallery access allowed for identity verification or payment verification must not be repurposed to shame the borrower.
Unconstrained or excessive processing of a contact list is prohibited.
Contact-list data must not be used to harass people or collect from individuals who were not named as guarantors.
The app should provide a separate, limited interface through which the borrower chooses any character reference or guarantor.
A character reference is not automatically a guarantor.

A character reference may be contacted to verify the borrower’s identity and the truth of information given during the application. The reference must be told why and how the contact details were obtained and must be offered an option to have the data removed as a reference.

Debt collection is different. For that purpose, the lender may contact a person who expressly agreed to be a guarantor. It may not treat every character reference, family member, friend, coworker, or phone contact as liable for the debt.

Tapping “Allow” or accepting a long privacy policy does not give the app unlimited authority. Consent must be sufficiently informed and specific, and the processing must remain lawful, necessary, and proportionate.

Preserve evidence before blocking or uninstalling the app

Digital evidence can disappear when an account is blocked, a message is deleted, or an app is removed. Before changing anything, preserve:

Full screenshots showing the message, sender, date, time, phone number, profile name, and account
A screen recording scrolling through the complete conversation
Original emails, text messages, chat exports, voice messages, and call logs
Links and screenshots of social-media posts, comments, group chats, or public-shaming material
Screenshots from relatives, coworkers, or other people contacted by the collector
The loan agreement, disclosure statement, statement of account, payment receipts, and transaction history
The app-store listing, developer name, privacy policy, website, application version, and download link
Screenshots of the app’s requested and granted permissions
The company name shown in the privacy notice, disclosure statement, bank transfer details, receipts, and collection messages
Your written complaint to the company and proof that it was delivered
Every company response, ticket number, and agency acknowledgment

Keep the original files. Back them up without cropping, annotating, or editing them. Create a simple chronology listing each incident, its date, the sender, the recipient, and the corresponding attachment.

Ask affected contacts whether they are willing to provide their original screenshots and a sworn statement. Do not secretly record a private telephone conversation without legal advice; the Anti-Wiretapping Act may apply. Preserve existing voice messages and other recordings that were lawfully obtained.

Protect your phone and accounts

After preserving the evidence:

Revoke unnecessary access to contacts, photos, camera, microphone, location, files, and call information.
Change passwords for the lending app, email, social-media, banking, and e-wallet accounts.
Enable multi-factor authentication where available.
Review active sessions and sign out unfamiliar devices.
Warn contacts that messages claiming to come from you or demanding payment may be unauthorized.
Check bank and e-wallet activity for transactions you did not approve.
Report the app to its official app-store listing after saving the listing details.
Do not send additional IDs, selfies, one-time passwords, banking credentials, or remote-access codes to a collector.

Revoking permission prevents future device access but may not delete data already copied. Send a separate written privacy request addressing retained and disclosed information.

Complain to the company first

Send the lender and its data protection officer a written complaint through a verifiable official channel. This step creates evidence and is generally important before escalating to the SEC or NPC.

State:

Your name and account or loan reference number
The app and lender’s complete names, if known
The collector’s name, phone number, profile, and agency
A dated description of each incident
The people who received messages and what was disclosed
The app permissions or data involved
The action you want the company to take

Request that the company:

Stop the abusive conduct immediately
Stop contacting anyone who is not a valid guarantor
Remove any public post or shaming material
Identify every recipient of your disclosed information
Preserve collection logs, call records, access logs, and instructions given to the collector
Explain the lawful basis, purpose, source, recipients, and retention period for your data
Restrict, erase, or securely dispose of information that is unlawfully processed or no longer necessary
Correct inaccurate account information
Provide the company’s written findings and corrective action
Communicate only through a specified official channel

Erasure is not absolute. A lender may retain information still necessary for a valid contract, legal obligation, defense of legal claims, or another lawful purpose. It must nevertheless stop unauthorized or excessive processing.

Keep proof of receipt. The NPC normally requires evidence that you first informed the company in writing and that it failed to take timely and appropriate action or failed to respond within 15 calendar days.

File an SEC complaint

Use the SEC iMessage portal. Its current user guide directs users to sign in through eSECURE, open a new ticket, and select Financing and Lending Companies Department — Complaints on Financing and Lending Companies.

Attach, as applicable:

A clear narrative and chronology
The lender’s corporate name and online lending app
Your loan documents and statement of account
Screenshots, exported messages, links, and call logs
Evidence sent by affected contacts
Your valid government-issued ID, with unrelated details masked where appropriate
Your written complaint to the company
Proof of delivery and the company’s response, or proof that it did not respond
The specific remedy or regulatory action requested

The app’s trade name may differ from the lender’s corporate name. Check the disclosure statement, privacy policy, app-store developer page, receipts, and payment-account name. You can also use Check with SEC to examine whether the company appears to have the necessary registration and authority.

If the company is absent from the database or concealed its identity, do not abandon the complaint. Give the SEC every identifying detail available, including phone numbers, URLs, app-store information, bank or e-wallet destination accounts, privacy-policy text, and screenshots.

File an NPC complaint

Use the NPC route when the app or collector accessed, stored, used, or disclosed personal data improperly. Borrowers and non-borrowers whose data were misused may file as affected data subjects.

Under the 2021 NPC Rules of Procedure, as amended in 2024, the usual process is:

Notify the lender, collection agency, or other responsible entity of the privacy violation in writing.
Allow it to take appropriate action. If it gives no response within 15 calendar days, or its action is untimely or inadequate, preserve that fact.
Download the current form from the NPC’s formal complaint page.
Complete and sign the complaint, have it notarized, and include the required verification and certification against forum shopping.
Attach the correspondence, evidence, witness affidavits if available, and the relief requested.
File personally, by registered mail, by courier, or by scanning and emailing the notarized complaint to complaints@privacy.gov.ph, as directed on the NPC filing page.
Follow the NPC’s instructions for payment and further submissions.

The current NPC schedule of fees lists a ₱500 base filing fee for complaints. Additional fees may apply if damages or special relief are requested. Qualified indigent complainants may seek exemption by submitting the required proof.

The NPC may waive the prior-notice requirement for good cause or serious violations, including situations involving grave and irreparable harm, the absence of an adequate remedy from the respondent, or conduct that is patently illegal. Waiver is discretionary, so explain and document the urgency.

If the company’s identity is unknown, the complaint may describe circumstances that can lead to its identification.

When the BSP is the correct regulator

An app may be operated by or offer credit for a bank, non-bank electronic-money issuer, pawnshop, money-service business, payment-system operator, or another BSP-supervised institution. In that situation:

Complain first through the institution’s free Financial Consumer Protection Assistance Mechanism.
If unresolved, escalate through the BSP Consumer Assistance channels and BSP Online Buddy.
Attach the institution’s final response or proof of your prior complaint, together with the loan records and evidence.

Check the loan contract and disclosure statement rather than assuming that the app-store developer is the regulated creditor. The SEC and BSP routes depend on the identity and regulatory status of the actual financial service provider.

Privacy concerns may still be reported separately to the NPC.

When police or NBI help is urgent

Do not wait for the lender’s internal process if there is:

A credible or imminent threat to kill, injure, abduct, or attack anyone
Extortion or a demand backed by threats of violence or unlawful disclosure
Unauthorized access to your financial, email, social-media, or device accounts
Identity theft or the creation of accounts or loans in your name
Threatened or actual distribution of intimate images
Stalking, a physical visit accompanied by threats, or disclosure of your live location
A fraudulent payment demand or impersonation of police, courts, or government officials

Call 911 or go to the nearest police station if anyone is in immediate danger. For computer-related evidence and investigation, the NBI Cybercrime Division’s citizen service provides for an in-person complaint, preliminary interview, sworn complaint sheet, supporting documents, witness statements, and examination of relevant devices when necessary.

Bring the original device if requested, but keep a backup of the evidence. Ask for a complaint, blotter, or reference number. File promptly because accounts, logs, and electronic evidence may be deleted, and legal filing periods vary according to the possible offense.

Common mistakes to avoid

Deleting the app immediately. Capture the app, account, permissions, privacy notice, and messages first.
Submitting only cropped screenshots. Include enough context to identify the sender, date, account, and complete statement.
Naming only the app. Identify the corporate lender, collection agency, developer, and payment recipient where possible.
Arguing only that repeated reminders are annoying. Describe the threats, false statements, disclosures, recipients, permissions, and resulting harm.
Skipping the written company complaint. Proof of prior notice is important for both SEC and NPC escalation.
Assuming a character reference owes the debt. A reference is not a guarantor without an express guaranty.
Posting unredacted IDs or loan records publicly. Give evidence to the agencies through official channels and protect unrelated personal information.
Paying a stranger’s personal account to stop threats. Confirm the amount and payment channel directly with the regulated provider.
Ignoring legitimate court papers. A collector’s threatening message is not a summons, but genuine documents from a court or government agency require prompt legal attention.
Assuming a complaint suspends the loan. Unless the lender, regulator, or court provides otherwise, filing a complaint does not by itself stop contractual due dates, interest, or lawful collection.

Getting legal help

Seek a lawyer promptly if:

You receive a genuine summons, subpoena, demand from a prosecutor, or court order
The lender disputes your identity or claims you committed fraud
Your employer, business, or reputation has suffered serious documented harm
Intimate images, medical information, government IDs, or financial credentials were exposed
You want compensation, an injunction, a cease-and-desist order, or criminal charges
Several lenders or collection agencies are involved
You cannot identify the entity responsible
The harassment continues after regulatory complaints
You are asked to sign a waiver, settlement, admission, or restructuring agreement you do not understand

A lawyer should review the loan documents and actual communications before identifying possible civil or criminal claims. Not every offensive message satisfies the elements of a specific crime, and regulatory violations do not automatically prove entitlement to damages.

Frequently asked questions

Can a lending app contact everyone in my phonebook?

Not for debt collection. Limited and proportionate processing may be allowed for lawful purposes, but unbridled processing of contacts is prohibited. For collection, the lender may contact a person who expressly agreed to be a guarantor—not ordinary contacts or character references.

Can the collector message my employer or family?

Merely being a relative, coworker, or employer does not make someone liable for the loan. Disclosure to such people to pressure or shame you may constitute unfair collection and unlawful personal-data processing. Preserve the exact message and the recipient’s evidence.

I granted contact and photo permissions. Can I still complain?

Yes. Permission does not excuse processing that was unnecessary, excessive, misleading, incompatible with the stated purpose, or used for harassment. The validity and scope of any consent depend on the notice, the choice offered, and the actual use of the data.

Can they post my name and photo because I missed a payment?

A lender may pursue lawful collection, but it may not use your photo or personal information to embarrass you or engage in unfair collection. Report the post to the SEC and NPC, and preserve the URL, screenshots, date, audience, and sharing history before requesting removal.

Does harassment erase the loan?

No. The enforceability and amount of the loan depend on the agreement, disclosures, payments, charges, and applicable law. Misconduct by the collector may create separate regulatory, privacy, civil, or criminal issues.

Can I be arrested simply because I cannot pay?

No person may be imprisoned merely for debt. However, conduct independent of nonpayment—if supported by evidence and satisfying the elements of a criminal offense—may be treated separately. A collector cannot create an arrest warrant by sending a threatening message.

What if the app is unregistered or has disappeared?

Report it anyway. Give the SEC, NPC, or law-enforcement agency every available identifier. The NPC’s loan-data rules expressly extend to persons acting as lenders whether or not they possess the required SEC authority.

Can a contacted relative or friend file a privacy complaint?

Yes, if that person’s own data was improperly obtained, used, or disclosed. The borrower may also submit the messages as evidence. Each affected person should preserve the original communication and may file in their own capacity or through a properly authorized representative.

Must I wait 15 days before going to the NPC?

Ordinarily, you must notify the responsible entity in writing and show that it failed to act appropriately or did not respond within 15 calendar days. The NPC may waive this requirement in a serious or urgent case, but the waiver must be justified and is not automatic.

How quickly will an agency resolve my complaint?

No fixed outcome or completion date can be promised. Processing time depends on jurisdiction, completeness of the complaint, service on the respondent, the need for investigation, and whether the case proceeds to mediation or adjudication. Keep the reference number and answer requests for additional information promptly.

Official sources and filing pages

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Rights, jurisdiction, and remedies depend on the loan documents, provider, communications, and evidence. Official sources and filing procedures were checked on 27 July 2026.