If an online lending app is threatening you, shaming you in group chats, calling your contacts, posting your photo, sending fake police or court warnings, or using your phone data to pressure you to pay, you can report the harassment to the NBI Cybercrime Division. Online loan harassment is not just a “collection issue.” Depending on what happened, it may involve cybercrime, threats, unjust vexation, data privacy violations, unfair debt collection, fraud, or identity misuse. This guide explains what to prepare, how to file with the NBI, when to also report to the SEC or National Privacy Commission, and what usually happens after you submit the complaint.

What Counts as Online Lending App Harassment?

A lender may legally remind a borrower about a debt. But collection becomes abusive when the app, collector, or collection agency uses fear, shame, threats, deception, or unlawful use of personal data.

Common examples include:

Calling or texting your relatives, officemates, Facebook friends, or phone contacts who are not guarantors or co-makers
Telling other people that you are a scammer, criminal, or “estafa” suspect because of an unpaid loan
Sending edited photos, threats, insults, or obscene messages
Posting your name, photo, ID, address, workplace, or loan details online
Creating group chats to shame you
Threatening arrest, police action, barangay blotter, “NBI case,” or court action without proper legal basis
Sending fake subpoenas, fake warrants, fake court summons, or fake lawyer letters
Using your contact list, photos, gallery, location, SMS, or other phone data beyond what is necessary for the loan
Calling repeatedly before 6:00 a.m. or after 10:00 p.m.
Pretending to be a police officer, court employee, prosecutor, barangay official, or NBI agent

The 2026 public advisory of the DICT, National Privacy Commission, and SEC specifically recognizes reports of online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data. It also states that contacting persons in the borrower’s contact list other than guarantors is prohibited for debt collection.

Why the NBI Cybercrime Division May Be the Right Office

The NBI Cybercrime Division is appropriate when the harassment is done through digital means, such as:

SMS, calls, messaging apps, email, social media, or online posts
Loan apps that access or misuse phone data
Fake online documents, fake notices, fake warrants, or fake legal threats
Identity theft, phishing, account takeover, or unauthorized access
Threats, coercion, humiliation, or defamatory statements sent electronically

Under Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, crimes under the Revised Penal Code and special laws may be covered when committed through information and communications technologies, and the NBI and PNP are designated law enforcement authorities for cybercrime cases. (Supreme Court E-Library)

The NBI’s official site lists cybercrime among its divisions and services, and the government’s 2026 online lending advisory identifies the NBI Cybercrime Division contact email as ccd@nbi.gov.ph and NBI telephone number as (632) 8523-8231 to 38. (National Bureau of Investigation)

Important Legal Rights Borrowers Should Know

You cannot be jailed for debt alone

Article III, Section 20 of the 1987 Philippine Constitution states that no person shall be imprisoned for debt or non-payment of a poll tax. This means nonpayment of a simple loan, by itself, is generally a civil matter. (Lawphil)

However, this does not protect a person from criminal liability if there is a separate criminal act, such as fraud, falsification, identity theft, threats, or use of a bouncing check. In the same way, a lender may pursue lawful collection, but it cannot use illegal threats or public shaming to force payment.

Lending companies must be authorized by the SEC

Under Republic Act No. 9474, or the Lending Company Regulation Act of 2007, a lending company must be a corporation and cannot conduct lending business unless it has authority to operate from the SEC. The SEC also has supervisory powers and may impose administrative sanctions, including fines, suspension, or revocation of authority. (Supreme Court E-Library)

This is why identifying the real company behind the app matters. The app name may be different from the SEC-registered corporate name.

Borrowers have financial consumer rights

Under Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act of 2022, financial consumers have rights to fair treatment, disclosure and transparency, protection against fraud and misuse, data privacy, and timely handling of complaints. (Supreme Court E-Library)

For online lending harassment, these rights matter because abusive collection often involves several violations at once: unfair treatment, hidden charges, misuse of data, and failure to provide a real complaint channel.

Unfair debt collection is prohibited

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing and lending companies. Prohibited acts include threats of violence or criminal means, threats to take actions that cannot legally be taken, insults or profane language, publication of borrowers’ personal information, false representation, deceptive means to collect, unreasonable contact hours, and contacting persons in the borrower’s contact list other than named guarantors or co-makers.

The SEC circular also makes the lending or financing company responsible for outsourced collectors or third-party service providers. A company cannot simply blame a collection agency if the abusive collection was done for its account.

Misuse of your phone contacts and personal data may violate the Data Privacy Act

Under Republic Act No. 10173, or the Data Privacy Act of 2012, personal information must be processed lawfully, fairly, and for legitimate purposes. Data subjects have rights to be informed, to access their data, to dispute inaccuracies, to request blocking or removal in proper cases, and to be indemnified for damages caused by unauthorized use of personal information. (National Privacy Commission)

The Data Privacy Act also penalizes unauthorized processing and unauthorized disclosure of personal information. This is important when a lending app accesses your contact list and tells third parties about your loan without a lawful basis. (National Privacy Commission)

Threats, coercion, and unjust vexation may be criminal

The Revised Penal Code penalizes grave threats, light threats, grave coercions, and unjust vexation. For example, Article 282 covers threats to inflict a wrong amounting to a crime, Article 286 covers coercion, and Article 287 covers unjust vexation. When these acts are committed through phones, apps, social media, or other ICT systems, RA 10175 may become relevant. (Lawphil)

Where to Report: NBI, SEC, NPC, or PNP?

Many victims file with only one office and then get frustrated when they are referred elsewhere. In practice, online lending harassment often requires parallel reporting.

Situation	Best Office to Report To	Why
Threats, fake warrants, fake subpoenas, online intimidation, identity theft, fraud, hacking, cyber libel, or harassment through apps/messages	NBI Cybercrime Division or PNP Anti-Cybercrime Group	These involve possible cybercrime or criminal conduct
Harassing collection, public shaming, threats to contact employer, unreasonable calls, abusive collectors	SEC Financing and Lending Companies Department / SEC i-Message	SEC regulates lending and financing companies
Misuse of contact list, unauthorized disclosure of loan details, access to photos/SMS/location, data privacy violations	National Privacy Commission	NPC handles Data Privacy Act complaints
Unauthorized e-wallet transactions, suspicious bank or payment activity	Bank, e-wallet provider, and appropriate regulator	Needed to freeze, trace, or dispute transactions

The 2026 government advisory directs reports of unfair debt collection practices to the SEC through imessage.sec.gov.ph, and other harassment, threats, frauds, and scams to the DICT Cyber Hotline, NBI Cybercrime Division, or PNP Anti-Cybercrime Group.

Step-by-Step: How to Report Online Lending App Harassment to the NBI Cybercrime Division

1. Preserve the evidence before deleting anything

Do not immediately uninstall the app, delete conversations, block every number, or factory-reset your phone before saving evidence. Digital evidence is strongest when it is complete, dated, and traceable.

Save:

Screenshots of messages, comments, posts, emails, and group chats
Screen recordings showing the sender profile, phone number, username, URL, date, and time
Call logs showing repeated calls and contact times
Voice recordings, if available
Links to posts, profiles, app store pages, websites, and ads
The loan contract, disclosure statement, privacy notice, payment schedule, and in-app terms
Proof of payment, GCash/Maya/bank transfer receipts, and loan disbursement records
Photos of fake subpoenas, warrants, police notices, or “legal demand” letters
Names and numbers of collectors
Messages sent to your relatives, officemates, employer, or contacts
Written statements from people who were contacted or shamed

For social media posts, capture the URL, not just the screenshot. For calls, keep the call log and number. For emails, preserve the full email header if possible. For app harassment, screenshot the app name, developer name, app store link, and permissions requested.

2. Make a simple timeline

NBI investigators handle many complaints. A clean timeline helps them understand the case quickly.

Use this format:

Date and Time	What Happened	Evidence
June 1, 9:15 p.m.	Collector texted: “Ipapahiya ka namin sa contacts mo.”	Screenshot 001
June 2, 7:30 a.m.	My sister received a message saying I was a scammer.	Screenshot 002; sister’s statement
June 3, 11:05 p.m.	Collector called 14 times after 10 p.m.	Call log 003
June 4	Fake court summons sent via Messenger.	Screenshot 004; PDF file

Do not exaggerate. Investigators and prosecutors look for consistency. Stick to facts: who, what, when, where, how, and what evidence proves it.

3. Identify the app and the company behind it

Online lending apps often use several names. Some collectors use fake names. Gather all identifying details:

App name
Developer name on Google Play or Apple App Store
Website or download link
SEC corporate name, if shown
Business address, if shown
Customer service email and hotline
Collection agency name, if disclosed
GCash, Maya, bank account, or payment channel used
Loan account number
Sender numbers, email addresses, Facebook profiles, Telegram usernames, or Viber accounts

Under RA 9474, the lender’s authority to operate matters because lending companies must have SEC authority before doing business. (Supreme Court E-Library)

4. File the report with the NBI

You may start through the NBI’s official Report to NBI page or contact the NBI Cybercrime Division by email. The NBI official contact page lists the main office at Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City, with hotline (02) 8523-8231. (National Bureau of Investigation)

When emailing or submitting an initial report, keep it organized:

Suggested subject line:

Complaint for Online Lending App Harassment / Threats / Data Privacy Abuse - [Your Full Name]

Suggested message format:

Your full name, mobile number, email, and city/province
Name of the lending app and company, if known
Short summary of what happened
Dates when harassment occurred
Why you believe it is cybercrime or online harassment
List of attached evidence
Names and contact details of witnesses, if any
Request for evaluation and instructions for formal complaint filing

Do not send passwords, OTPs, private account logins, or unnecessary sensitive files. If evidence is large, organize it in folders and label each file clearly.

5. Prepare a complaint-affidavit if required

For a criminal complaint to move forward, you will usually need a complaint-affidavit. This is a sworn written statement narrating the facts based on your personal knowledge.

A strong complaint-affidavit should include:

Your identity and contact details
The respondent’s identity, if known
App name, company name, collector name, phone numbers, accounts, and links
Exact words used in threats or insults, if relevant
How your personal data was misused
How your contacts, family, workplace, or reputation were affected
A numbered list of evidence
A statement that your attachments are true copies or screenshots of the communications received

If you are in the Philippines, the affidavit is usually notarized before a notary public or subscribed before the appropriate officer. If you are abroad, ask the NBI or the receiving prosecutor what form they will accept. In many Philippine proceedings, affidavits executed abroad may need consular acknowledgment or apostille, depending on where and how the document was executed.

6. Cooperate with the investigator

After filing, the NBI may:

Assess whether the facts fall under cybercrime or another offense
Ask for your phone or device for inspection or forensic preservation
Ask follow-up questions about the app, account, number, or suspect
Request additional screenshots, links, transaction records, or witness statements
Coordinate with platforms, telcos, payment channels, or other agencies where legally possible
Refer the matter to the prosecutor’s office for preliminary investigation if there is sufficient basis

The NBI report is usually the start of law enforcement evaluation. It is not the same as a court case yet. For criminal prosecution, the case generally proceeds to the prosecutor, who determines probable cause.

7. File parallel complaints with SEC and NPC when needed

If the complaint involves abusive collection, also file with the SEC i-Message platform, which is the SEC’s public complaint and ticketing channel. The SEC page states that the public may submit complaints and check ticket status through that system. (Securities and Exchange Commission)

If the complaint involves misuse of your contact list or personal data, file with the National Privacy Commission. The NPC explains that a formal complaint must follow a specific format, may use its complaint form, must be notarized, and may be submitted in person, by courier, or by scanned email submission. (National Privacy Commission)

Evidence Checklist for NBI Cybercrime Complaints

Evidence	Why It Matters
Screenshots with date, time, sender, and full message	Shows the actual threat or harassment
Screen recording scrolling through the conversation	Helps prove the screenshot was not isolated or edited
Call logs	Shows repeated calls and unreasonable hours
Fake summons, fake warrant, fake lawyer letter	May support fraud, forgery, or intimidation claims
Messages sent to contacts	Shows public shaming and data misuse
Witness statements from relatives or officemates	Helps prove third-party harassment
Loan agreement and payment records	Shows the relationship and amount involved
App store link and developer details	Helps identify the operator
Privacy notice and permission screenshots	Useful for NPC data privacy complaint
IDs and proof of identity	Required to verify the complainant

Practical Timelines and What to Expect

Timelines vary depending on the completeness of evidence, number of respondents, whether the suspect is identifiable, and whether platform or telco data is needed.

Stage	Typical Practical Timeline
Initial report or email acknowledgment	Same day to several working days, depending on workload
Assessment or interview	A few days to a few weeks
Evidence review and additional requests	Weeks, sometimes longer
Coordination with platforms, telcos, or payment channels	Often slow; may require formal legal process
Referral to prosecutor, if warranted	Several weeks to months
Prosecutor preliminary investigation	Often several months, depending on docket congestion

Common bottlenecks include incomplete screenshots, anonymous prepaid numbers, deleted accounts, foreign-based app operators, unregistered lending platforms, and complainants who cannot appear or execute affidavits.

Common Mistakes That Weaken a Complaint

Deleting the app too early

Uninstalling the app may remove useful in-app notices, loan details, permissions, and account information. Preserve evidence first.

Sending only cropped screenshots

Cropped screenshots may hide the sender, timestamp, URL, or account identity. Submit full screenshots and screen recordings when possible.

Not getting statements from contacted relatives or officemates

If the main abuse is that the lender contacted third parties, their statements matter. Ask them to save the messages and write what happened.

Treating the NBI as a debt negotiator

The NBI handles possible crimes. It does not compute balances, waive penalties, restructure loans, or decide whether the debt is valid. Debt disputes and harassment complaints may overlap, but they are not the same.

Ignoring legitimate debt issues

Reporting harassment does not automatically erase the loan. If the loan is valid, the lender may still pursue lawful collection. The key point is that collection must be legal, fair, and respectful of privacy.

Publicly posting the collector’s personal details

Victims are understandably angry, but posting private numbers, photos, or accusations online can create a separate legal problem. Preserve evidence and report through proper channels.

Special Notes for OFWs, Foreigners, and Filipinos Abroad

You can still prepare a complaint even if you are outside the Philippines. The most important steps are to preserve digital evidence, organize a timeline, and contact the NBI Cybercrime Division for instructions.

For OFWs and Filipinos abroad:

Use your Philippine phone number, email, and overseas address in the complaint.
Keep the original phone used to receive the harassment if possible.
Ask contacted relatives in the Philippines to preserve their own evidence.
If an affidavit is required, ask whether it must be consularized, acknowledged before a Philippine Embassy or Consulate, or apostilled.
If your Philippine contacts are being harassed, they may also file their own complaint or witness statement.

For foreigners dealing with Philippine online lending apps:

You may report harassment if the app, collector, victim, affected contacts, payment channel, or harmful conduct has a Philippine connection.
Provide passport or government ID details only through official complaint channels.
If your documents are executed abroad, authentication requirements may apply before Philippine authorities accept them formally.

Frequently Asked Questions

Can I report online lending app harassment directly to the NBI?

Yes. If the harassment involves threats, fraud, fake legal documents, identity misuse, unauthorized access, cyber libel, or abuse through digital platforms, you may report it to the NBI Cybercrime Division. You may also be referred to the SEC, NPC, PNP Anti-Cybercrime Group, or prosecutor depending on the facts.

Should I report to NBI or SEC first?

If there are threats, fake warrants, scams, identity theft, or serious online harassment, report to the NBI or PNP Anti-Cybercrime Group. If the main issue is abusive collection by a lending or financing company, also report to the SEC. Many strong complaints are filed with both.

Can online lending apps contact my relatives or officemates?

For debt collection, the 2026 DICT-NPC-SEC advisory states that lending and financing companies may contact only the guarantor, and contacting persons in the borrower’s contact list other than those named as guarantors is prohibited.

Can I be arrested for not paying an online loan?

Not for debt alone. The Constitution prohibits imprisonment for debt. But you may face legal consequences if there is a separate criminal issue, such as fraud, falsified information, identity theft, or another punishable act. Lenders and collectors should not threaten arrest simply to scare you into paying.

What if the app sends a fake subpoena, warrant, or court summons?

Save the file, screenshot the message, preserve the sender details, and report it. Fake legal documents may indicate fraud, intimidation, computer-related forgery, or other offenses depending on the facts. Under RA 10175, computer-related forgery and fraud are recognized cybercrime offenses. (Supreme Court E-Library)

What if the online lending app is not SEC-registered?

Report it to the SEC and include the app name, download link, screenshots, and payment accounts. Under RA 9474, a lending company cannot conduct business without SEC authority to operate. (Supreme Court E-Library)

Do I need a lawyer to file with the NBI?

You can file an initial report yourself. A lawyer can help if the facts are complex, if you need a detailed complaint-affidavit, if you are also facing a collection case, or if the harassment caused serious damage to your employment, business, or reputation.

How long does an NBI cybercrime complaint take?

Some complaints are assessed quickly, but investigation and prosecution can take weeks or months. Cybercrime cases often require technical tracing, platform records, telco information, payment channel records, or witness affidavits, which can slow the process.

Should I still pay the loan after filing a harassment complaint?

If the debt is valid, filing a harassment complaint does not automatically cancel it. You may still settle or dispute the amount through lawful channels. Keep all payment proof. Do not pay extra “penalties” or “settlement fees” sent through suspicious personal accounts without verifying the lender and the computation.

What if my contacts are still being harassed after I report?

Continue preserving new evidence. Ask your contacts not to argue with collectors; instead, they should save screenshots, call logs, and numbers. Submit supplemental evidence to the NBI, SEC, or NPC under the same complaint reference if available.

Key Takeaways

Online lending app harassment may involve cybercrime, unfair debt collection, data privacy violations, threats, coercion, or fraud.
The NBI Cybercrime Division is appropriate when the abuse is done through phones, apps, messages, social media, fake online documents, or misuse of digital data.
Preserve full evidence before deleting apps, messages, call logs, or posts.
A strong complaint includes a timeline, screenshots, screen recordings, call logs, app details, payment records, and witness statements.
Report serious threats, fake legal documents, identity misuse, and cyber harassment to the NBI or PNP Anti-Cybercrime Group.
Report unfair debt collection to the SEC and misuse of personal data or contact lists to the National Privacy Commission.
You cannot be jailed for debt alone, but lawful debts do not disappear just because the collector acted abusively.
Contacting your phone contacts who are not guarantors is prohibited for debt collection under current government guidance.
The fastest way to help investigators is to submit organized, factual, complete, and properly labeled evidence.