Being bombarded with insistent calls, texts, and social media messages from online lending apps demanding payment — and especially discovering that your parents, siblings, friends, employer, or even distant contacts have received messages shaming you about an unpaid loan — is a deeply stressful and humiliating experience faced by many Filipinos. These aggressive tactics often stem from apps that request broad permissions to access your phone’s contact list, camera, or other data during the loan application, then use that information to pressure repayment through embarrassment rather than proper channels. Such practices cross the line from legitimate collection into illegal harassment and privacy violations. This article explains exactly which Philippine laws protect you, why these methods are prohibited, and the precise steps you can take to document everything, demand that the harassment stops, and file effective complaints with the right government agencies.

Why These Tactics Violate Philippine Law

Online lending platforms and their collectors frequently harvest personal data beyond what is necessary and then weaponize it. This is not allowed.

Data Privacy Act of 2012 (Republic Act No. 10173)

The Data Privacy Act establishes clear rules for how personal information must be collected, used, and protected. Processing must be lawful, fair, and for a specified, legitimate purpose. It must also be proportionate — only the minimum data needed — and data subjects must be informed and able to exercise rights such as objecting to processing.

Contact lists, messages about your debt sent to third parties, and any public or semi-public shaming involve processing of personal data (yours and your contacts’). Broad permissions granted when installing an app do not give ongoing, unlimited consent to contact your entire network or disclose your financial situation to embarrass you. The National Privacy Commission has been explicit on this point.

NPC Circular No. 20-01 (Guidelines on the Processing of Personal Data for Loan-Related Transactions), as amended by Circular No. 2022-02, directly addresses online lending apps. It prohibits requiring unnecessary permissions such as access to phone contact lists, social media contacts, camera, gallery, location, or storage beyond strict Know-Your-Customer needs during application. Once verification is complete, these permissions must be turned off or prompted for the user to disable. Harvesting, copying, or saving contact details “for use in debt collection or to harass in any way the borrower or his/her contacts” is expressly prohibited. Lenders must use a separate interface for character references or co-makers chosen by the borrower. Using a borrower’s photo to embarrass or harass for collection is also banned. Lenders remain fully accountable for any personal data under their control.

Violations can lead to NPC investigations, cease-and-desist orders, administrative fines, orders to delete data, and referral for criminal prosecution under the Data Privacy Act (which provides for imprisonment and fines in serious cases).

SEC Memorandum Circular No. 18, Series of 2019

Most online lending platforms operate as lending companies or financing companies regulated by the Securities and Exchange Commission under the Lending Company Regulation Act of 2007 (RA 9474). SEC MC No. 18, s. 2019 (Prohibition on Unfair Debt Collection Practices of Financing Companies and Lending Companies) applies to all such entities and their third-party collectors.

It prohibits a range of abusive practices, including:

Use or threat of violence or other criminal means against a person’s reputation or property.
Threats to take actions that cannot legally be taken.
Use of obscenities, insults, or profane language that abuses the borrower.
Contacting persons in the borrower’s contact list other than those expressly named as guarantors or co-makers (this remains unfair even if the borrower gave broad app consent).
Public shaming, humiliation, or harassment of the borrower or third parties.
Failure by collectors to properly identify themselves.

The SEC has revoked or suspended certificates of authority of multiple online lending platforms for repeated violations of this circular, often involving exactly the contact-list shaming and harassment described here. A 2026 joint advisory from DICT, NPC, and SEC further reinforces that contacting non-guarantors on contact lists and other harassing tactics are not permitted.

Additional Protections

The Cybercrime Prevention Act of 2012 (RA 10175) covers cyber libel (when defamatory statements about your debt or character are published online or in group chats) and online threats or harassment. The Revised Penal Code provides for unjust vexation (Article 287) and, in extreme cases, grave threats or coercion. The Civil Code (Articles 19, 20, and 21) allows claims for damages when rights are exercised abusively or acts are done contrary to good morals, causing harm. You can pursue civil damages and injunctive relief in court alongside administrative complaints.

These laws work together. The core violation in most cases — misusing your contact list and shaming you or your network — is best addressed first through the NPC (privacy) and SEC (unfair lending practices).

Immediate Steps to Stop the Harassment

Act quickly and methodically. Documentation is your strongest tool.

Preserve every piece of evidence right away. Do not delete messages, call logs, or app data. Take clear, timestamped screenshots of every harassing message or call (include the sender/number, date, time, and full content). Screenshot the app’s permission settings (phone Settings > Apps > [App Name] > Permissions) showing contact list or other access. Photograph or note any public or group-chat posts. Ask family members, friends, or coworkers who were contacted to send you their own screenshots or short written statements describing what they received and how it affected them. Back everything up to cloud storage or email it to yourself with dates.
Block the harassers and instruct your contacts. Block all numbers, emails, and social media accounts linked to the app or collectors. Tell your contacts to block them too and to forward any new messages to you without engaging or replying. Do not argue or make payment promises through these channels while harassment continues.
Send a formal written cease-and-desist notice. This step is important. Email or message the app’s official support address and Data Protection Officer (usually listed in the app’s privacy policy or terms). Clearly state your full name, any loan reference number, a chronological summary of the harassing incidents with dates, and that the practices violate the Data Privacy Act, NPC Circular No. 20-01, and SEC MC No. 18, s. 2019. Demand that they immediately stop all contact with you and any third parties, cease processing or disclosing your data and your contacts’ data for collection or shaming purposes, delete relevant records where required, and confirm compliance in writing within a specific short period (e.g., 5–7 days). Send with read receipts or via registered mail if possible. Keep a complete copy and proof of sending. This written notice fulfills the exhaustion requirement under NPC rules and creates a strong record.
Handle serious threats separately. If collectors threaten physical harm, violence, damage to property/reputation in a criminal way, or make grave threats, go immediately to the nearest police station to file a blotter. For online threats, libel, or coordinated harassment, contact the PNP Anti-Cybercrime Group or NBI Cybercrime Division with your evidence.
Limit further exposure. Revoke unnecessary app permissions where still possible. Consider whether you need to change your primary phone number or social media settings temporarily (document the reason). Focus on your well-being while the formal process moves forward.

Filing Complaints with Government Agencies

You can (and often should) file with multiple agencies because they address different aspects of the same problem. Complaints are generally free or low-cost for individuals, and many can be submitted electronically.

National Privacy Commission (NPC) — Best Starting Point for Contact-List and Privacy Violations

The NPC has handled hundreds of similar cases against online lending apps and has issued cease-and-desist orders and conducted hearings.

Important prerequisite (NPC Rules of Procedure, Circular No. 2021-01 as amended): You must generally first inform the Personal Information Controller (the lending company or app operator) in writing of the violation and give them 15 calendar days to respond or take appropriate action. The formal complaint will usually not be given due course unless this step is shown or the NPC waives it for serious cases involving grave or irreparable harm. Your cease-and-desist notice above satisfies this.

Steps to file:

Download the current Complaint-Affidavit form (with Q&A guidance) from the official National Privacy Commission filing page. Use the latest version (as of 2026, the form includes helpful sections for describing violations).
Complete it carefully. Identify yourself as complainant and the company (use all known names, trading names, or “John Does” if exact corporate identity is unclear). Narrate the facts in clear, numbered paragraphs with specific dates and descriptions of messages to you and others. Cite the Data Privacy Act provisions violated and NPC Circular No. 20-01 (especially on contact access and harassment). Describe the harm (emotional distress, reputational damage, impact on family/employment). State the relief sought: investigation, cease-and-desist order, data deletion, administrative penalties, and referral for criminal action if warranted.
Attach labeled annexes: all screenshots and evidence, copy of your written notice to the company and any response (or proof of no response), copy of your valid government-issued ID, and notarized or sworn statements from affected contacts if available.
Have the Complaint-Affidavit notarized before a notary public. If you are abroad, have it done before a Philippine consular officer or authorized notary; apostille may be needed depending on requirements.
Submit the notarized form and annexes (clear PDF scans preferred for email): via the NPC eComplaint portal if available, by email to complaints@privacy.gov.ph, or in person/by courier to the current NPC office (check the official website for the exact address, recently in the Quezon City area). Refer to NPC Circular No. 2023-01 for the current schedule of fees and charges.
You should receive a docket number. The NPC evaluates complaints promptly and may issue provisional orders, require hearings (which you or a representative can attend), and investigate thoroughly.

Strong, well-organized evidence significantly improves outcomes. The NPC can order the company to stop the practices and delete data quickly in clear cases.

Securities and Exchange Commission (SEC) — For Unfair Debt Collection by Regulated Lenders

File here if the platform is (or should be) an SEC-registered lending or financing company. The SEC has revoked licenses of platforms for exactly these collection abuses.

How to file:

Use the convenient SEC i-Message portal for online submission.
Or email the Financing and Lending Companies Division (e.g., flcd_complaints@sec.gov.ph) or the Enforcement and Investor Protection Department.
Provide the same detailed facts and evidence, but focus on specific violations of SEC MC No. 18, s. 2019 (contacting non-guarantors, shaming/harassment, etc.). Include the company’s registered name if known and any Certificate of Authority details.
The SEC investigates, can impose fines, suspend or revoke authority to operate, and has done so repeatedly against abusive online platforms.

Filing with both NPC and SEC in parallel is common and effective because the violations overlap but are enforced by different regulators.

Criminal Complaints — PNP Anti-Cybercrime Group or NBI

For acts that may amount to cyber libel, unjust vexation, threats, or other crimes:

File a police blotter at your local station or directly with the PNP Anti-Cybercrime Group (current contact details on their official channels or acg@pnp.gov.ph).
Or coordinate with the NBI Cybercrime Division.
Bring all timestamped evidence. They can investigate, file appropriate cases in court, and pursue prosecution, which may result in imprisonment and fines for responsible individuals.

These criminal routes can proceed alongside your NPC and SEC complaints.

Common Challenges and Practical Realities

Many people face similar obstacles. Here is how to handle them.

Difficulty identifying the exact company. Apps sometimes use multiple names or third-party collectors. List every known name, the app’s package identifier if possible, website, and contact details. Regulators have investigative powers and have acted against numerous platforms even when identities were initially unclear.
Harassment continues after filing. Document every new incident with fresh evidence and submit updates or supplemental complaints to your docketed cases. This often prompts faster agency action.
No response from the company. This is common; the complaint process continues regardless.
You are an OFW or living abroad. The processes are accessible remotely. Use email and portals for filing. Handle notarization at a Philippine Embassy or Consulate. Many overseas Filipinos have successfully pursued these complaints. Time zone differences for hearings can usually be managed.
Emotional and practical toll. The legal process takes time (evaluation can be relatively quick, but full resolution varies from weeks to several months depending on complexity and agency workload). Prioritize your mental health and support network while documenting consistently.
The underlying debt. Filing these complaints addresses the illegal collection methods. It does not automatically erase or forgive the debt. If you dispute the amount, interest rates, or terms (for example, under the Civil Code on unconscionable contracts or the Truth in Lending Act), or need restructuring options, seek separate advice from a lawyer or accredited financial counselor. Illegal harassment does not strengthen the lender’s position.

Frequently Asked Questions

Can online lending apps legally contact my family, friends, or coworkers about my debt?
No. NPC Circular No. 20-01 and SEC MC No. 18, s. 2019 prohibit contacting persons in your contact list other than named guarantors or co-makers. Doing so for shaming or pressure is an unfair and illegal practice, regardless of broad permissions granted in the app.

Do I lose my rights if I actually owe money or missed payments?
No. The existence of a debt does not authorize harassment, shaming, or misuse of personal data. Your protections under the Data Privacy Act and fair collection rules apply regardless of the underlying obligation.

What is the most important evidence for a strong complaint?
Clear, timestamped screenshots of messages (to you and third parties), app permission screens, your formal written notice to the company, and statements from affected contacts. Chronological organization and specificity help regulators act faster.

How long does it take for the NPC or SEC to respond or stop the harassment?
Initial evaluation and docketing often happen within days to a couple of weeks. Cease-and-desist directives or other provisional relief can come relatively quickly in well-documented cases. Full investigation and penalties take longer but put sustained pressure on the company.

Can OFWs or Filipinos abroad file these complaints?
Yes. Both agencies accept remote filings via email and portals. Notarize the complaint affidavit at a Philippine Embassy or Consulate. Many overseas complainants have succeeded with scanned documents.

What penalties can the apps or collectors face?
NPC can issue fines, data deletion orders, and refer cases for criminal prosecution under the Data Privacy Act. SEC can fine companies significantly and revoke their authority to operate as lenders (it has done so in multiple online lending cases). Criminal convictions under the Cybercrime Act or Revised Penal Code can result in imprisonment and fines for individuals.

Should I just pay the loan to make the harassment stop?
Paying a legitimate debt is a personal decision, but you should never feel coerced by illegal tactics. Many people file complaints while separately addressing the debt through proper negotiation or legal channels. Illegal collection methods expose the lender to liability and do not erase your rights.

What if they threaten to sue me or report me to credit bureaus for complaining?
Document any such threats as additional evidence. Filing a good-faith regulatory complaint is your protected right. Legitimate collection uses court processes, not harassment.

Key Takeaways

Contacting your personal network for shaming and using harvested contact lists for debt collection violates the Data Privacy Act of 2012 (RA 10173) and NPC Circular No. 20-01, as well as SEC Memorandum Circular No. 18, Series of 2019 on unfair debt collection practices.
Begin by meticulously documenting every incident with timestamps and screenshots, then send a formal written cease-and-desist notice to the company citing the specific laws violated.
File complaints with the National Privacy Commission (primary for privacy and contact-list misuse) and the Securities and Exchange Commission (for unfair lending collection practices). Many people file with both. Add criminal complaints with PNP ACG or NBI when threats or libel are involved.
Follow the NPC exhaustion requirement by first giving the company written notice and 15 days to respond, unless the NPC waives it for serious harm.
Strong, organized evidence and persistence through the proper channels have led regulators to issue orders, impose penalties, and even revoke licenses of abusive platforms. You have enforceable rights — use the documented processes available to stop the harassment and protect yourself and your family.