A legitimate debt does not give an online lending app the right to threaten you, publish your photo, insult you, message everyone in your phone, or tell your employer and relatives that you are a scammer. Philippine regulators now expressly prohibit online lending platforms from using contact lists for harassment or collection from people who are not valid guarantors. You may report the same conduct to several agencies at once, depending on whether it involves unfair collection, misuse of personal data, threats, fraud, or public shaming.

What Is Online Lending App Harassment or Contact Shaming?

Harassment goes beyond an ordinary reminder that a payment is due. It may include:

Repeated calls or messages intended to intimidate or exhaust you
Threats to harm you, your family, reputation, employment, or property
Messages calling you a thief, scammer, criminal, or fraudster
Edited “wanted” posters using your photograph or government ID
Posts in Facebook groups, Messenger group chats, or other public channels
Messages sent to relatives, friends, co-workers, customers, or employers to shame you
Threats of immediate arrest, police raids, or imprisonment merely because you cannot pay
Accessing, copying, or storing your phone contacts for mass collection messages
Using your photographs, social-media information, or phone permissions for purposes unrelated to verifying your identity
Demanding payment from a person listed only as a character reference

The March 18, 2026 joint advisory of the Department of Information and Communications Technology, National Privacy Commission, and Securities and Exchange Commission states that online lending platforms must not engage in harassment, intimidation, public shaming, or unlawful processing of personal data. It specifically prohibits contacting people in a borrower’s contact list for debt collection unless they are named guarantors who expressly agreed to that role.

A character reference is not automatically a guarantor

A character reference merely helps confirm a borrower’s identity or background. A guarantor expressly agrees to answer for another person’s debt under the terms of a valid agreement.

Article 2055 of the Civil Code of the Philippines provides that a guaranty is not presumed and must be express. Therefore, a lender cannot make a relative, friend, or co-worker pay simply because the borrower entered that person’s name or number in an application. The 2026 joint advisory also requires lending apps to distinguish clearly between character references and guarantors. (Lawphil)

Your Rights Under Philippine Law

Several laws and regulations may apply to the same collection campaign.

Protection from abusive debt collection

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, requires financial service providers to treat consumers fairly, protect their information, and avoid abusive debt-collection or recovery practices. (Lawphil)

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by financing and lending companies. The SEC may investigate the company and impose administrative sanctions, including fines and the suspension or revocation of its authority to operate, depending on the violation. (SEC Appointment System)

A collector may:

Send a truthful payment reminder
Request payment through reasonable and confidential communication
Provide an accurate statement of account
Offer restructuring or settlement
File a proper civil collection case

A collector may not turn those lawful remedies into threats, humiliation, deception, or misuse of personal data.

Protection of your contacts, photographs, and personal information

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal data to be processed for a declared, legitimate, and proportionate purpose. Depending on the circumstances, unlawful processing, unauthorized disclosure, or malicious disclosure may result in administrative sanctions and criminal penalties. (Lawphil)

NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, prohibits unrestrained processing of contact lists, including processing that leads to harassment, unfair collection, or attempts to collect from people who are not guarantors. An app should obtain only the minimum access necessary to let the borrower select a reference or guarantor. It should not harvest the borrower’s entire address book.

Access to a camera or photograph may be justified for identity verification or “know your customer” procedures. That does not authorize the lender to use the borrower’s photograph in a humiliating poster or social-media post. Once an app permission is no longer needed, the platform should prompt the user to revoke it. (National Privacy Commission)

Possible criminal and civil liability

Depending on the exact words, conduct, and evidence, aggressive collection may potentially involve:

Grave threats, light threats, or grave coercion under the Revised Penal Code
Unjust vexation for conduct that causes unjustified annoyance, distress, or irritation
Libel or cyberlibel when defamatory statements are published online
Offenses under the Data Privacy Act
Computer-related offenses under the Cybercrime Prevention Act of 2012, Republic Act No. 10175

Not every insulting text automatically becomes cyberlibel. Investigators will examine what was said, whether another person saw it, whether the statement identified the victim, whether it was defamatory, and whether the required criminal intent or malice can be established. (Lawphil)

Articles 19, 20, 21, and 26 of the Civil Code may also support a claim for damages when a person abuses a legal right, violates another person’s privacy, or deliberately causes injury in a manner contrary to morals, good customs, or public policy. (Lawphil)

Preserve Evidence Before Blocking or Uninstalling the App

Strong evidence often makes the difference between a general allegation and an actionable complaint.

Before blocking numbers, deleting messages, or uninstalling the app:

Take full screenshots. Include the sender’s number or account name, date, time, and complete message. Avoid submitting only tightly cropped images.
Make a screen recording. Scroll slowly through the conversation, caller profile, social-media post, or group chat. This helps show continuity and reduces claims that screenshots were taken out of context.
Save original files. Export chats where possible. Download photographs, voice messages, emails, and videos without editing them.
Record calls lawfully. Preserve call logs and voicemails. Secretly recording a private conversation may raise issues under the Anti-Wiretapping Act, so do not assume that every hidden call recording is lawful.
Ask contacted people for evidence. Relatives, friends, co-workers, or employers should save the messages they personally received. Their screenshots and written accounts may prove third-party disclosure and reputational harm.
Preserve the loan records. Save the loan agreement, disclosure statement, repayment schedule, proof of disbursement, payment receipts, account balance, privacy notice, app-permission screen, and collection notices.
Identify the legal operator. Record both the app’s brand name and the company behind it. Check the loan contract, privacy notice, app-store listing, text-message footer, and payment instructions for the corporate name, SEC registration number, Certificate of Authority, business address, collection agency, and data protection officer.
Document actual harm. Keep genuine HR notices, business cancellations, medical records, counselling receipts, transportation expenses, and proof of lost income if they resulted from the harassment.

Store an untouched copy in cloud storage or on another device. Do not factory-reset the phone until the evidence has been backed up.

Protect Your Phone, Accounts, and Contacts

After preserving the evidence:

Revoke the app’s access to contacts, SMS, photographs, files, camera, microphone, and location.
Uninstall the app if you no longer need it for account access.
Change important passwords and enable two-factor authentication.
Warn your contacts that they may receive unauthorized messages.
Report fake profiles, defamatory posts, and impersonation accounts to the platform.
Never give a collector your OTP, PIN, email password, contact list, or a new selfie holding your ID.
Pay only through a verified official channel stated in the contract or confirmed by the legitimate lender.
Request a written statement of account before paying a collector whose authority is unclear.

Revoking app permissions does not automatically erase valid loan records. A lender may retain information needed for legitimate contractual, regulatory, accounting, or legal purposes, but it cannot use that information for unrelated shaming or harassment.

How to Report an Online Lending App Step by Step

You do not have to choose only one agency. A single incident may justify complaints to the SEC, NPC, and law-enforcement authorities.

1. Identify the company and collection agency

A complaint against “the lending app” is easier to investigate when it includes:

App name
Corporate operator
SEC registration number, if available
Certificate of Authority number, if available
Collection agency or individual collector
Phone numbers, email addresses, social-media accounts, and payment accounts used
Loan or account number
Date the harassment began

Registration as a corporation does not by itself authorize a company to operate as a lending company. Under the Lending Company Regulation Act of 2007, Republic Act No. 9474, a lending company must have the required SEC authority. (Lawphil)

The SEC iMessage system also lists services for checking the status of a financing or lending company’s Certificate of Authority.

2. Send a written notice to the lender

This is not required when there is an immediate threat, but it can create useful evidence that the company knew about the misconduct.

Send the notice to the lender’s customer-service department, complaints unit, and data protection officer. State:

I object to the use of my contact list, photographs, and personal information for harassment, public shaming, or collection from persons who are not valid guarantors. Stop all unlawful third-party communications and preserve all records relating to my account and the collection campaign. Please identify the authorized collector, provide a complete statement of account, and communicate with me only through [email or another chosen channel].

Do not demand deletion of every record without qualification. Ask the company to delete or restrict data that was collected unlawfully or is no longer necessary, while preserving evidence relevant to your complaint.

3. File an unfair-collection complaint with the SEC

The SEC is the main regulator for financing companies, lending companies, online lending apps, online lending platforms, and their collection agencies.

Use the official SEC iMessage portal. The current process generally requires an eSECURE account:

Sign in to SEC iMessage.
Select Financing and Lending Companies Department.
Select Legal and Enforcement Division.
Choose Complaints on Financing and Lending Companies.
Complete the complaint form and upload your evidence.
Save the unique ticket number so you can track the submission.

The portal’s user guide explains that each request generates a trackable ticket. The 2026 joint advisory also lists the SEC hotline 1-4732 or 1-4SEC for reports involving unfair collection practices. (Securities and Exchange Commission)

In the complaint, clearly separate:

The amount you borrowed
The payments already made
Any disputed fees or interest
The specific harassment or disclosure
The dates, numbers, accounts, and people involved
The remedy requested, such as investigation, cessation of unlawful collection, correction of records, or regulatory sanctions

4. File a data-privacy complaint with the NPC

File with the National Privacy Commission when the lender:

Harvested your phone contacts
Messaged non-guarantors
Disclosed your debt to relatives, friends, customers, or co-workers
Used your photograph or ID for shaming
Published personal information online
Refused to explain how it obtained or used your information
Continued unnecessary processing after the purpose had ended

The NPC complaint-filing page instructs complainants to download and complete the complaint form, have it notarized, and submit it personally, by courier, or by sending a scanned copy to complaints@privacy.gov.ph. (National Privacy Commission)

Prepare:

Notarized complaint form or complaint-affidavit
Government-issued ID
Screenshots, messages, call logs, posts, and witness evidence
Loan and payment documents
Privacy notice and app-permission records
Proof that you complained to the company, if available
Authorization and IDs if a representative will file for you

For paper filing, the NPC’s published Citizens’ Charter requires an original set for each respondent plus three additional copies. Online filing starts with scanned copies, but the NPC may later require originals. (National Privacy Commission)

5. Report threats, fraud, or cyber harassment to law enforcement

Use this route when there are threats of violence, extortion, impersonation, fake arrest notices, fraudulent payment accounts, defamatory public posts, or other possible crimes.

The 2026 joint advisory lists these channels:

Office	Contact details
DICT Cyber Hotline	1326@dict.gov.ph
NBI Cybercrime Division	ccd@nbi.gov.ph; (632) 8523-8231 to 38
PNP Anti-Cybercrime Group	acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (632) 8723-0401 local 7491

For an NBI or PNP report, bring your phone, identification, screenshots, loan records, URLs, account names, payment details, and a chronological written summary. Intake may happen on the same day, but digital investigation, identification of anonymous collectors, preservation requests, subpoenas, and referral for prosecution can take substantially longer.

A formal criminal complaint may eventually require a sworn complaint-affidavit and supporting documents for preliminary investigation before the prosecutor’s office. (National Bureau of Investigation)

6. Use the BSP process only when the provider is BSP-supervised

Most stand-alone lending apps and financing companies belong under SEC supervision. However, the account may be offered by a bank, digital bank, e-money issuer, or another entity supervised by the Bangko Sentral ng Pilipinas.

For a BSP-supervised provider:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.
Keep the reference number and response.
Escalate unresolved complaints through the BSP Online Buddy or the BSP consumer-assistance channels.

BSP guidance expressly directs complaints against ordinary financing companies, lending companies, online lending apps, and their collection agencies to the SEC.

What Your Complaint Should Say

A useful complaint is factual, chronological, and specific. Include:

Your full name and contact details.
The app name and legal company name.
When and how you obtained the loan.
The principal amount, amount received, payments made, and claimed balance.
The first date of harassment.
The exact statements, threats, posts, or disclosures.
The names or numbers of people contacted.
Whether any contacted person was actually a named, consenting guarantor.
The app permissions you were required to grant.
The harm caused.
Previous complaints to the lender and its response.
A numbered list of attachments.

Avoid exaggeration. Do not say that the company contacted “everyone” when the available evidence shows three people. Specific, provable facts are usually more persuasive than emotional conclusions.

Fees and Typical Timelines

Process	Fee or cost	Practical timing
SEC iMessage ticket	No ordinary ticket fee is stated in the current public user guide; the SEC will advise if a separate formal proceeding requires payment	Ticket generation is immediate; assessment and investigation may take weeks or months
NPC complaint	Published schedule lists a ₱500 complaint fee, with possible additional legal research or damages-related charges	Acknowledgment may come within about one working day; full adjudication can take many months
NBI or PNP incident report	Generally no filing fee for reporting an incident	Intake may be same day; investigation and prosecution take longer
Notarization	Depends on the notary and location	Usually same day if documents and identification are complete

The NPC’s published service materials describe an end-to-end administrative process that can extend to approximately 376 days, excluding certain delays or periods attributable to the parties. Actual cases may finish earlier or later depending on completeness, service on respondents, hearings, motions, and the complexity of digital evidence. The published fee schedule also provides exemptions for qualified indigent litigants who submit the required proof, including a barangay certificate of indigency and supporting affidavits. (National Privacy Commission)

Common Mistakes That Weaken Complaints

Deleting everything immediately

Blocking the collector may protect your peace of mind, but first preserve the messages, account details, and URLs. Deleted posts and disappearing accounts are harder to authenticate later.

Reporting only the app’s brand name

The app may be operated by one corporation, financed by another, and using a separate collection agency. Name all identifiable entities and collectors.

Treating the harassment complaint as a loan cancellation request

A valid debt does not disappear because the collector violated the law. Regulators can investigate harassment and data misuse, while the lender may still pursue lawful collection of the valid obligation.

Paying an unverified collector

A threatening message may come from an unauthorized agent or scammer. Confirm the collector’s authority and payment channel directly with the legal lender.

Posting IDs and screenshots publicly

Publicly posting your unredacted ID, loan documents, phone number, or complete evidence can expose you to further identity theft. Submit unredacted records through official channels and redact sensitive details from public posts.

Retaliating against collectors

Do not threaten the collector, publish the collector’s private information, or send defamatory messages. Retaliation can create a separate complaint and distract from the original misconduct.

Filing From Abroad or as a Foreigner

Filipinos overseas may generally use the SEC iMessage portal and email a scanned notarized NPC complaint. Keep the original notarized documents because the agency may require them later.

The NPC’s published Citizens’ Charter allows complaints by Filipino citizens and by foreign nationals whose personal data is processed in the Philippines. (National Privacy Commission)

For a document signed outside the Philippines:

Use a local notary who can properly verify your identity and signature.
Ask the receiving agency whether an apostille or Philippine consular authentication is required for that document and stage of the proceeding.
Keep the original document and proof of notarization.
Consider authorizing a Philippine representative if physical submission or personal follow-up becomes necessary.

An apostille should not be obtained automatically without checking. Initial electronic filing requirements and later evidentiary requirements may differ.

Frequently Asked Questions

Can a lending app contact everyone in my phone?

No. Online lending platforms are prohibited from using the borrower’s contact list for collection from people who are not named, consenting guarantors. Minimum access to select a reference or guarantor does not authorize copying and messaging the entire address book.

Can a lender call my employer or co-workers?

A collector must not disclose your debt to co-workers or use workplace communication to shame or pressure you. A person at your workplace cannot be treated as liable unless that person expressly became a guarantor. Confidential communication directed only to you is different from broadcasting the debt to your employer or colleagues.

Is it legal to post my photograph and call me a scammer?

Using your photograph in a public debt-shaming post may violate SEC collection rules and the Data Privacy Act. False or malicious accusations may also raise libel or cyberlibel issues, depending on the wording, publication, and evidence.

Can I complain even when I really owe money?

Yes. The existence of a debt does not authorize threats, insults, public humiliation, or unauthorized disclosure of personal data. Be honest about the loan and focus the complaint on the unlawful collection conduct.

Will reporting the app erase my loan?

No. A complaint can lead to investigation, sanctions, correction of unlawful practices, or possible claims for damages, but it does not automatically cancel a valid principal obligation.

Can a collector have me arrested for an unpaid online loan?

Mere nonpayment of debt is not a ground for imprisonment. Article III, Section 20 of the 1987 Constitution states that no person shall be imprisoned for debt. A separate alleged offense—such as fraud committed when obtaining the loan—would require its own evidence, complaint, investigation, and lawful court process. A collector cannot cause an immediate arrest merely by sending a text message. (Lawphil)

Do I need a lawyer to report an online lending app?

A lawyer is not required to create an SEC iMessage ticket, submit an NPC complaint, or make an initial police or NBI report. The NPC complaint must generally be notarized, and legal assistance may become useful if the case involves substantial damages, criminal charges, hearings, or disputed electronic evidence.

Is a character reference responsible for the loan?

No, not merely because the person was listed as a reference. A guaranty must be express. The lender should be able to show that the person knowingly and voluntarily agreed to become a guarantor.

What if the lending app is unregistered or has disappeared?

Preserve the app-store page, website, advertisements, text messages, payment accounts, phone numbers, loan documents, and corporate information. Report the matter to the SEC and, where fraud, impersonation, or anonymous cyber harassment is involved, to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.

Key Takeaways

A real unpaid loan does not authorize harassment, threats, contact shaming, or public humiliation.
Lending apps may not message people in your contact list for collection unless they are named guarantors who expressly consented.
Report unfair collection by lending and financing companies through the SEC iMessage portal.
Report contact harvesting, unauthorized disclosure, and misuse of photographs or personal data to the National Privacy Commission.
Report threats, extortion, fake arrest notices, impersonation, fraud, and public cyber harassment to the PNP, NBI, or DICT.
Preserve complete, original evidence before blocking numbers or uninstalling the app.
Identify both the app brand and the legal company or collection agency behind it.
Filing a harassment complaint does not automatically cancel a valid debt, but the lender must pursue payment only through lawful and fair methods.