Quick answer

You can report an online lending app to more than one authority because harassment and misuse of personal data may involve different violations:

Report unfair debt collection by a lending or financing company to the Securities and Exchange Commission’s Financing and Lending Companies Department (SEC-FINLEND) through SEC iMessage.
Report unauthorized access, disclosure, public shaming, or other misuse of personal data to the National Privacy Commission (NPC). Ordinarily, you must first complain to the lender in writing and allow 15 calendar days from receipt for an appropriate response, unless an exception applies.
Report threats, extortion, impersonation, fraud, account hacking, or other possible crimes immediately to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. Do not wait 15 days if anyone is in immediate danger.

A legitimate debt does not give a lender permission to threaten, insult, publicly shame, or indiscriminately contact people in your phone. Conversely, abusive collection does not automatically erase a valid loan. Keep the debt dispute and the harassment or privacy complaint clearly documented as separate issues.

What online lenders are not allowed to do

The rules apply not only to the lending company but also to collectors, employees, agents, service providers, and online platforms acting for it.

Under the Financial Products and Services Consumer Protection Act, regulated financial service providers must treat clients fairly, protect client data, maintain a free consumer-assistance mechanism, and avoid abusive collection or debt-recovery practices. A provider may also be responsible for the conduct of its agents and, in qualifying cases, solidarily liable with accredited third-party service providers.

The SEC’s unfair-collection rules prohibit practices such as:

Using threats of violence or other criminal means to harm a person, reputation, or property;
Using insults, obscenities, profane language, or other abusive treatment;
Threatening action that cannot legally be taken;
Falsely representing that the collector is a lawyer, police officer, court employee, or government representative;
Using false or deceptive means to collect or obtain information about a borrower;
Publicly disclosing or publishing a borrower’s identity and debt to shame the borrower;
Communicating loan information to people who are not authorized to receive it, subject to narrow lawful exceptions;
Contacting a person before 6:00 a.m. or after 10:00 p.m., subject to exceptions under the SEC rule, including certain seriously overdue accounts, the borrower’s express permission, or circumstances in which those hours are the only reasonable or convenient opportunity for contact.

A collection message is not unlawful merely because it demands payment firmly or warns of a remedy the lender may lawfully pursue. The exact language, frequency, recipients, timing, and truthfulness of the communication matter.

Contact lists, references, and guarantors

The government’s current position is especially clear about contact-list abuse. Under the March 18, 2026 joint DICT-NPC-SEC advisory:

Unnecessary app permissions and unauthorized, excessive, or disproportionate processing of personal data are prohibited.
An app may not use contact-list data for harassment, public shaming, or unfair collection.
For debt collection, the lender may contact a person identified as a guarantor, but may not contact other people in the borrower’s contact list merely because their details were accessible to the app.
A character reference provided for identification or verification is not automatically a guarantor.
A person becomes a guarantor only after separately consenting to assume responsibility for the loan in case of default.
Camera or photo-gallery access must be tied to a specified, legitimate purpose, such as identity or payment verification. A borrower’s photograph may not be altered, posted, or circulated to embarrass the borrower into paying.
Personal data may be retained only as long as necessary for its lawful purpose, legal claims, or a period required by law, after which it must be securely disposed of.

The Data Privacy Act of 2012 also requires transparency, legitimate purpose, and proportionality. The fact that a borrower clicked “Allow” or accepted general terms does not necessarily authorize every later use of the data. Consent and other asserted legal grounds must still satisfy the law, and processing must remain necessary and proportionate.

What to do immediately

1. Preserve the evidence before blocking or uninstalling anything

Save evidence in its original form whenever possible:

Screenshots and screen recordings showing the complete conversation, account name, phone number, date, and time;
Original SMS, email, voicemail, chat, and call logs;
Links, usernames, profile pages, posts, comments, group chats, and public-shaming materials;
Copies of messages sent to relatives, co-workers, employers, references, or other contacts;
Statements or screenshots from those recipients;
The app’s name, developer, download page, package name, website, and privacy notice;
Screenshots of every permission requested or granted;
Loan agreement, disclosure statement, payment schedule, receipts, transaction records, and account history;
Collector names, numbers, payment instructions, e-wallet accounts, and bank details;
Your written complaint to the lender and proof that it was received;
Any response, ticket number, acknowledgment, or refusal from the lender.

Keep unedited copies. Back them up to a secure location. For disappearing messages or public posts, capture the material promptly and include enough surrounding information to show where it came from. Avoid editing screenshots in ways that hide dates, numbers, recipients, or context.

2. Secure your device and accounts

After preserving evidence:

Revoke unnecessary access to contacts, calls, SMS, storage, camera, microphone, location, and social-media accounts through your phone settings.
Change passwords for email, financial, and social-media accounts if you reused a password or suspect unauthorized access.
Enable multi-factor authentication.
Review active sessions and connected apps.
Warn affected contacts not to open links, provide one-time passwords, send money, or engage with impersonators.
Ask a platform to preserve and remove abusive posts, but save your evidence first.
Do not install another app or configuration file sent by a supposed collector.

Revoking permissions may stop future access, but it cannot retrieve data already copied by the operator. Include any continued use of previously harvested information in your complaint.

3. Send a written complaint to the lender

Address the complaint to the lender’s consumer-assistance unit and, for a privacy issue, its data protection officer. Use the legal company name if you can identify it—not only the app’s brand.

State:

Your name and account or loan reference;
The dates and description of each incident;
The numbers, accounts, collectors, or agents involved;
Which people were contacted and whether any was an actual guarantor;
What personal information was accessed, used, or disclosed;
Why the collection statement was false, threatening, abusive, or unauthorized;
The action you want, such as stopping third-party contact, correcting records, restricting unlawful processing, removing a public post, preserving logs, or investigating the collector;
A request for a written response and complaint reference number.

Do not send more identification documents than reasonably necessary. Redact unrelated account numbers and personal data from supporting files.

For an NPC complaint, preserve proof that the company received this written notice. The general rule is that the company must be given an opportunity to act, and either fails to take timely or appropriate action or does not respond within 15 calendar days from receipt.

The NPC may dispense with prior exhaustion in limited situations recognized by its rules, including when there is no plain, speedy, or adequate remedy from the respondent or when the challenged action is patently illegal. Whether an exception applies depends on the facts, so explain any need for immediate intervention and provide supporting evidence.

How to complain to the SEC

Use SEC iMessage and select the service for complaints involving financing and lending companies under the Financing and Lending Companies Department. The SEC’s official iMessage user manual explains how to create an eSECURE account, open a ticket, upload files, reply to the assigned department, and monitor the ticket.

Include:

The app and legal company names;
The company’s SEC registration or certificate-of-authority details, if known;
Your loan reference and relevant agreement;
A chronological account of the collection conduct;
Exact words used in threats or false claims;
Dates and times of calls or messages;
Names and numbers of collectors;
Proof of disclosure to third parties or public shaming;
Copies of your complaint to the company and its response;
A clear request for investigation under the unfair-debt-collection and financial-consumer-protection rules.

The March 2026 government advisory also lists the SEC hotline as 1-4732 (1-4SEC). Use the official iMessage ticket for a traceable written record.

Check whether the operator is authorized through the SEC’s Check with SEC service. An app-store listing, social-media page, business registration, or SEC company registration alone does not necessarily prove authority to operate as a lending or financing company. Report an apparently unlicensed operator and preserve the claims it made about its identity or authority.

If the lender is a bank, e-money issuer, or another institution supervised by the Bangko Sentral ng Pilipinas rather than an SEC-regulated lending or financing company, use the institution’s consumer-assistance mechanism first and then the appropriate BSP complaint channel. The regulator depends on the legal entity behind the app, not merely its brand.

How to file a privacy complaint with the NPC

Follow the NPC’s current formal complaint instructions and downloadable form. The NPC requires a complaint in the prescribed form that is written, signed, verified, and notarized.

The complaint should identify:

The affected data subject;
The respondent, or available facts that may help identify it;
The privacy violation or data breach;
The personal data involved;
The people or entities that received the data;
The harm or injury suffered;
The relief requested;
Your prior written correspondence with the respondent and its action or failure to act.

Attach the evidence and proof of compliance with the 15-calendar-day exhaustion rule, or explain and support the exception you rely on. A representative generally needs proper written authority; special rules apply to minors, persons alleged to be incompetent, and non-resident Filipino citizens.

The completed complaint may be submitted using the options stated on the NPC page: in person, by qualified courier, or by sending a scanned copy to the official complaint email shown there. Check the current form, filing instructions, and amended NPC Rules of Procedure immediately before filing because an incomplete, unverified, or unsupported complaint may be dismissed or returned for compliance.

An NPC proceeding can address unlawful personal-data processing and may result in appropriate administrative or enforcement action. Criminal liability under the Data Privacy Act is determined through the legally required process; filing a complaint does not guarantee prosecution, compensation, or a particular outcome.

When to report to cybercrime authorities

Contact law enforcement promptly if the conduct includes:

A credible threat of physical harm, kidnapping, sexual violence, or property damage;
Extortion or a demand backed by threats to expose private information;
Account takeover, hacking, identity theft, or unauthorized financial transactions;
Impersonation of police, courts, lawyers, or government personnel;
Fabricated warrants, subpoenas, case numbers, or arrest notices;
Distribution of intimate images or sexualized edited photographs;
Fraudulent payment links, malware, phishing, or demands to send money to suspicious personal accounts;
Stalking or disclosure of your live location.

The joint government advisory lists these reporting contacts:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

For immediate danger, contact emergency services or the nearest police station. Tell a trusted person where you are, avoid meeting a collector, and do not negotiate alone with someone making violent threats.

If you are not the borrower

You may still complain if the app processed or disclosed your personal data, repeatedly harassed you, falsely named you as a guarantor, or sent you another person’s loan information.

Reply once in writing, if safe, that:

You are not the borrower;
You did not consent to act as guarantor, if true;
You demand that unauthorized collection contact stop;
You request the source of your personal data and appropriate correction, restriction, or deletion consistent with applicable retention duties.

Preserve the message and your response. A character reference is not automatically liable for the debt. Do not pay merely because a collector accessed your number or claims that the borrower listed you.

Common mistakes to avoid

Deleting the app or messages too soon. Capture the evidence first.
Reporting only the app’s brand. Identify the legal operator, collector, payment recipient, and developer where possible.
Sending a vague complaint. Use a dated chronology and attach proof for each incident.
Omitting proof of receipt. For the NPC’s general exhaustion requirement, show when the lender received your written complaint.
Treating every collection reminder as illegal. Focus on the threatening, deceptive, abusive, public, excessive, or unauthorized conduct.
Assuming harassment cancels the debt. Request an account statement and dispute incorrect charges separately.
Paying an unfamiliar personal account. Verify payment instructions through the lender’s official channel and obtain a receipt.
Posting unredacted evidence publicly. This can expose your own data, the borrower’s data, and third parties’ information.
Threatening or insulting the collector in return. Keep your communications factual; hostile replies can complicate the evidence.
Using only app-store reporting. Platform reports may remove an app but do not replace complaints to the proper Philippine authorities.

Frequently asked questions

Can a lender contact my family, employer, or co-workers?

Not merely because their numbers appear in your contacts. Current NPC guidance prohibits contacting contact-list entries for collection unless the person was named as a guarantor and actually consented to that role. Limited contact made for a lawful purpose may require a fact-specific assessment, but disclosing the debt or using third parties to shame or pressure the borrower is a serious warning sign.

Is a character reference responsible for my loan?

No, not solely because the person was listed as a character reference. A guarantor is different and must have separately consented to assume responsibility for the loan.

Can the app access all my contacts because I clicked “Allow”?

Permission at the device level does not create unlimited legal authority. Collection and use must still be transparent, lawful, necessary, and proportionate. Unbridled harvesting or use of contacts for harassment and debt collection outside actual guarantors is prohibited.

Can collectors have me arrested for failing to pay?

Ordinary failure to pay a debt does not by itself prove a crime. A lender may pursue remedies that the law and contract permit, but collectors may not fabricate criminal cases, warrants, or government authority. Obtain legal advice promptly if you receive genuine court papers, and verify them directly with the named court rather than through the collector’s number or link.

Should I stop paying after harassment?

Not automatically. Continue to assess the underlying obligation using the contract, payment records, and an accurate statement of account. You may challenge unauthorized charges or an incorrect balance while separately reporting abusive collection. Pay only through a verified channel and keep every receipt.

Can I file with both the SEC and NPC?

Yes, when the facts involve both unfair collection and misuse of personal data. A criminal or cybercrime report may also be appropriate. Explain in each filing where else you reported the matter and use consistent evidence and dates.

Is there a deadline?

Do not delay. The Financial Products and Services Consumer Protection Act contains prescriptive periods for claims under that law, while Data Privacy Act offenses and other possible causes of action may be governed by different rules. Platform evidence can also disappear quickly. Preserve the evidence and seek individualized legal advice if significant time has passed.

Do I need a lawyer?

A lawyer is not always required to submit an agency complaint, but legal help is advisable when there are credible threats, public or intimate-image exposure, identity theft, substantial financial loss, disputed court documents, multiple victims, or uncertainty about the proper respondent. Seek urgent help if you receive an authentic summons, subpoena, complaint, or court order because response periods may be short.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the agreement, communications, identities of the parties, regulator involved, and available evidence. Official sources and procedures were checked as of July 27, 2026.