Online lending app harassment can feel frightening because collectors often threaten arrest, message relatives or co-workers, edit borrowers’ photographs, or post accusations such as “scammer” and “estafador.” A lender may collect a legitimate debt, but it cannot use threats, humiliation, deception, or unlawful access to personal data. The fastest way to stop the abuse is to preserve strong evidence, restrict the app’s access, send a formal written demand, and file the complaint with the correct regulator.

In a joint advisory dated 18 March 2026, the Department of Information and Communications Technology, National Privacy Commission, and Securities and Exchange Commission again confirmed that online lenders must not harass borrowers, process contact lists excessively, contact people who are not guarantors, or use personal data for public shaming. These rules apply to lending conducted through mobile apps, websites, and other financial-technology systems, whether the platform is recorded with the SEC or operating without proper authority.

What Counts as Online Lending App Harassment?

Debt collection becomes potentially unlawful when the lender or collection agent does any of the following:

Threatens violence, physical harm, property damage, arrest, deportation, or another action that the collector has no legal authority to take.
Uses obscene, insulting, degrading, or profane language.
Repeatedly calls or messages in a manner intended to frighten or exhaust the borrower.
Contacts relatives, friends, co-workers, employers, social-media connections, or random people copied from the borrower’s phone.
Tells third parties that the borrower has an unpaid loan when they have no legitimate reason to receive that information.
Posts the borrower’s name, photograph, identification card, loan balance, phone number, or alleged delinquency online.
Creates group chats to shame the borrower.
Edits a photograph to label the borrower a thief, fraudster, criminal, prostitute, or scammer.
Pretends to be a police officer, lawyer, sheriff, court employee, or government investigator.
Sends fake warrants, subpoenas, court summonses, criminal complaints, or barangay notices.
Falsely increases the balance or conceals that the amount is being disputed.
Refuses to identify the lending company behind the app or the collector’s true identity.

A firm but truthful payment reminder is not automatically harassment. A lender may contact the borrower, demand payment, propose restructuring, send a lawyer’s demand letter, report information through legally authorized credit-reporting channels, or file a civil case. What it cannot do is use the debt as permission to destroy the borrower’s privacy or reputation.

Your Rights Under Philippine Law

Several Philippine laws may apply to the same act of harassment.

Legal basis	Protection relevant to online lending harassment
SEC Memorandum Circular No. 18, Series of 2019	Prohibits threats, obscenities, publication of borrower information, deception, certain inconvenient contacts, and communication with people in the borrower’s contact list who are not proper guarantors or co-makers.
Republic Act No. 11765, Financial Products and Services Consumer Protection Act of 2022	Prohibits financial service providers from using abusive collection or debt-recovery practices and protects the right to fair and respectful treatment.
Republic Act No. 10173, Data Privacy Act of 2012	Requires personal-data processing to be lawful, transparent, necessary, and proportionate; provides rights to information, access, objection, blocking or erasure in proper cases, damages, and complaint.
NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02	Regulates how lenders collect and use contact lists, photographs, device permissions, reference information, and other personal data in loan transactions.
Civil Code Articles 19, 20, 21, and 26	May support a civil claim for damages when a lender abuses its rights, violates the law, acts contrary to morals or good customs, or intrudes into another person’s privacy and family relations.
Revised Penal Code and RA No. 10175, Cybercrime Prevention Act of 2012	Depending on the exact words and conduct, threats, coercion, unjust vexation, libel, or cyberlibel may be investigated.

SEC Memorandum Circular No. 18 specifically prohibits violence or threats of criminal harm, threats to take action that cannot legally be taken, abusive language, publication of borrower information, false representations, and deceptive collection methods. It also requires collectors to disclose their true identity and leaves the lending or financing company responsible even when collection is outsourced to a third-party agency.

Can the lending app contact people in your phone?

As a rule, it may not contact random people in your contact list to collect your debt.

The 2026 joint government advisory states that contacting anyone in the borrower’s contact list other than a properly designated guarantor is prohibited. A character reference is not automatically a guarantor. A guarantor must have expressly consented to assume responsibility if the borrower defaults.

A person who actually signed the loan as a co-maker, co-borrower, or guarantor is different from someone whose number merely appeared in the borrower’s phone. Lenders should also provide separate fields for character references and guarantors so that the two roles are not deceptively combined.

Can collectors call before 6 a.m. or after 10 p.m.?

SEC Memorandum Circular No. 18 treats contact before 6 a.m. or after 10 p.m. as unreasonable or inconvenient, subject to a technical exception when the account has been past due for more than 15 days or when the borrower expressly agreed that those hours were convenient. Even when that exception applies, threats, obscenities, relentless calling, public shaming, and other abusive conduct may still violate separate provisions of law.

Can an unpaid borrower be arrested?

Article III, Section 20 of the 1987 Constitution provides that no person shall be imprisoned for debt. A collector cannot lawfully have someone arrested merely because an ordinary loan remains unpaid. (LawPhil)

This does not erase the debt. The lender may pursue lawful civil remedies. A separate criminal issue may arise where there is independent evidence of fraud from the beginning, a violation of the Bouncing Checks Law, falsified documents, identity theft, or another distinct offense. Nonpayment alone is not automatically estafa.

How to Stop Online Lending Harassment Step by Step

1. Preserve the evidence before blocking or uninstalling the app

Capture more than a single cropped message. Save:

The complete message thread, including dates and times.
The sender’s number, profile, account name, and platform.
The app name, icon, developer name, package information, and store listing.
The loan agreement, disclosure statement, repayment schedule, and privacy notice.
Screenshots of app permissions.
URLs and screenshots of public posts, comments, group chats, and shared photographs.
Call logs showing the frequency and time of calls.
Payment receipts and the names of bank accounts or e-wallets receiving payment.
Messages sent to relatives, employers, references, and co-workers.
The collector’s name, claimed position, and company.
Any fake warrant, subpoena, barangay notice, or court document.

Ask each contacted person to keep their own screenshots. Their copies show that the information was actually disclosed to a third party. A short signed statement identifying when and how they received the message may later strengthen an SEC, NPC, police, or court complaint.

Keep the original files and the original device when possible. Do not edit the screenshots or place text over them. Save backup copies in cloud storage or email them to yourself.

Do not secretly record a private telephone conversation without understanding the Anti-Wiretapping Act. Republic Act No. 4200 generally requires authorization from all parties to record a private communication. Safer evidence includes call logs, voicemail voluntarily left by the collector, written messages, and detailed notes made immediately after the call. (LawPhil)

2. Restrict the app’s permissions

After preserving evidence:

Turn off access to contacts, call logs, photographs, storage, camera, microphone, location, and social-media accounts unless genuinely needed.
Remove unnecessary permissions through the phone’s privacy settings.
Change passwords for email, social media, e-wallets, and cloud accounts if the app may have obtained access.
Enable two-factor authentication.
Hide your social-media friends list and restrict who can tag or mention you.
Review active device sessions and log out unfamiliar devices.

Revoking permission stops future access through the phone, but it does not automatically delete information already copied to the lender’s system. That is why a written privacy demand and regulatory complaint may still be necessary.

The NPC permits access to a camera or photograph only for legitimate purposes such as identity verification or know-your-customer procedures. A borrower’s photograph must not be used to harass or embarrass the borrower. Permissions should be switched off or withdrawn once their legitimate purpose has been completed. (National Privacy Commission)

3. Identify the real company behind the app

The app’s brand name may be different from the legal name of the lender. Look for the corporation name in:

The loan contract and disclosure statement.
The app’s privacy notice and terms of service.
Payment instructions or account beneficiary details.
Email footers and SMS notices.
The app-store developer page.
The collector’s demand letter.

Check the company using the SEC’s Check with SEC service or its corporate records. A normal SEC corporation registration is not enough by itself. A company engaged in lending or financing must also have the appropriate Certificate of Authority under the Lending Company Regulation Act or Financing Company Act. The SEC regulates lending and financing companies under RA No. 9474 and RA No. 8556. (SEC Appointment System)

4. Send a written demand to stop the harassment

Send the notice to the lender’s customer-service department, compliance officer, data protection officer, and collection agency. Use email or another method that produces proof of delivery.

A practical notice may read:

Subject: Demand to Stop Unfair Debt Collection and Unlawful Processing of Personal Data

I am the borrower for account or loan number ______ under the ______ app.

On the dates listed in the attached evidence, your company or collection agents contacted persons who are not my guarantors, disclosed my loan information, used threatening or insulting language, and/or published my personal data.

I demand that you immediately:

Stop contacting my relatives, friends, employer, co-workers, character references, and other persons who did not expressly consent to act as guarantors.

Remove all public posts, edited photographs, group messages, and disclosures concerning my debt.

Stop threats, abusive language, deceptive legal notices, and unreasonable communications.

Identify the legal lender, collection agency, responsible collector, and data protection officer.

State what personal data you obtained, the source of the data, the purpose of processing, and the persons to whom it was disclosed.

Stop processing personal data not necessary for loan servicing, legal compliance, or the establishment or defense of legitimate legal claims.

Securely delete data that is no longer necessary or lawfully retained.

Preserve all records relevant to these incidents.

All future communications should be sent to me in writing through ______.

Please provide your written action and response within 15 calendar days.

The 15-day period is particularly important for an NPC complaint. Under the NPC’s amended Rules of Procedure, a complainant ordinarily must first notify the lender in writing and allow it an opportunity to act. A privacy complaint may be dismissed if the lender was not given this opportunity, although the NPC may waive the requirement where serious, irreparable, or patently illegal conduct justifies immediate intervention.

5. Separate the harassment dispute from the loan balance

Request a complete written statement showing:

Original principal.
Interest.
Processing and service fees.
Late charges and penalties.
Payments already credited.
Current outstanding balance.
Legal name of the creditor.
Official payment channels.

Do not send payment to a collector’s personal bank or e-wallet account without written confirmation from the lender and an official receipt. A complaint against harassment does not automatically cancel a valid debt, and stopping payment without reviewing the contract can result in additional lawful charges or civil collection.

If the amount is disputed, state clearly which charges are disputed and why. Keep paying any amount formally agreed under a valid restructuring arrangement, rather than relying on an informal promise made through chat.

6. Preserve first, then report and request takedown

For a Facebook post, group chat, messaging account, or other online publication:

Save the full URL, account name, group name, date, comments, and number of shares.
Take screenshots showing that the post was publicly accessible or sent to third parties.
Ask recipients to preserve what they received.
Report the post through the platform’s privacy, harassment, impersonation, or doxxing channel.
Include the URL and takedown request in the written demand to the lender.

Do not retaliate by publishing the collector’s private information or making unverified accusations. That can create a separate privacy or defamation dispute.

Where to File a Complaint

Securities and Exchange Commission

For unfair collection by a lending company, financing company, or its collection agency, file through the SEC’s iMessage ticketing system and select the complaint category for financing and lending companies.

Attach:

Completed complaint information.
Valid government-issued ID.
Loan contract and disclosure statement.
Payment records.
Screenshots and message exports.
Proof that third parties were contacted.
Public-post URLs.
The lender’s corporate name and app name.
Your written demand and the company’s response, if any.

The SEC sends a copy of a sufficient complaint to the lending or financing company and ordinarily gives it 10 days from receipt to submit an answer or comment. The SEC may require a reply, close a resolved complaint, refer privacy issues to the NPC, or commence an administrative case when sufficient grounds exist. The SEC cannot itself rewrite the contract, cancel the debt, or judicially declare the loan void. (SEC Appointment System)

National Privacy Commission

File with the NPC when the problem involves:

Contact-list harvesting.
Messages sent to non-guarantors.
Publication of a name, photograph, ID, phone number, or loan details.
Excessive app permissions.
Refusal to explain how personal data was obtained or shared.
Continued retention or use of unnecessary data.
An edited photograph or public debt-shaming post.

The NPC’s formal complaint page provides the complaint form and submission instructions. The complaint must generally be notarized and may be submitted personally, by courier, or through the authorized NPC email channel. It should include proof of the prior written notice to the lender, the 15-day response period or inadequate response, supporting evidence, the relief requested, and a certification against forum shopping. (National Privacy Commission)

The base NPC filing fee is ₱500 under NPC Circular No. 2023-01. Additional fees may apply when damages are claimed. Qualified indigent complainants may seek exemption by submitting the required proof. Notarial and courier expenses are separate. (National Privacy Commission)

A complainant facing continuing and serious misuse of personal data may also ask about an application for a temporary ban on processing. This is a separate urgent remedy that generally requires a motion, a summary hearing, and a bond unless an exemption applies.

PNP Anti-Cybercrime Group, NBI, or DICT Cyber Hotline

Report immediately when there are credible threats of violence, extortion, impersonation, fake legal documents, account hacking, fraud, or potentially criminal public posts.

The March 2026 joint advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; telephone (02) 8723-0401 local 7491

Bring or attach your identification, chronological affidavit, screenshots, URLs, phone numbers, transaction records, witness details, and original device when requested.

Bangko Sentral ng Pilipinas

Some digital loans are offered by banks, digital banks, e-money issuers, or other BSP-supervised institutions rather than SEC-regulated lending companies.

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, escalate through the BSP Online Buddy or BSP Consumer Assistance channels. The BSP requires proof that the complaint was first raised with the supervised institution. (Bangko Sentral ng Pilipinas)

Practical Timelines and Requirements

Process	Important documents	Procedural milestone	Practical expectation
Written demand to lender	Demand letter, evidence, proof of delivery	Allow up to 15 calendar days for the NPC exhaustion requirement unless urgent harm justifies a waiver	Some lenders stop third-party contacts quickly; disputed cases may require regulatory action
SEC complaint	ID, loan documents, receipts, screenshots, company details	Respondent is generally given 10 days to answer or comment	Administrative evaluation and contested proceedings can take several months
NPC complaint	Notarized complaint, evidence, prior written notice, response or proof of no response, certification against forum shopping	Case assignment is contemplated within five calendar days; preliminary evaluation and service follow	These are internal milestones, not a guaranteed final-decision date
BSP escalation	Prior complaint to supervised institution, its response, loan records and evidence	The institution is generally directed to answer within 15 days under BSP-CAM	Mediation or further proceedings may follow if unresolved
Cybercrime report	ID, affidavit, original digital evidence, URLs, account details and witnesses	File immediately for ongoing threats or account compromise	Investigation time depends on account identification, preservation requests and cooperation of platforms

The most common bottlenecks are an unidentified corporate operator, incomplete screenshots, deleted messages, lack of proof that third parties were contacted, and failure to send a prior written privacy complaint. Foreign app operators and disposable phone numbers can also slow service and identification.

Possible Criminal and Civil Cases

Public shaming is not automatically one specific crime. The correct case depends on exactly what was said, who received it, and how it was communicated.

Possible issues include:

Grave threats or other threats when the collector threatens unlawful harm.
Grave coercion when intimidation is used to force an act that the collector has no right to compel in that manner.
Unjust vexation for conduct intended to annoy, distress, or torment where the elements of a more specific offense are not established.
Libel or cyberlibel when a defamatory accusation identifying the borrower is published to another person through writing or an online system.
Data Privacy Act offenses for unauthorized processing, processing for an unauthorized purpose, malicious disclosure, or unauthorized disclosure.
Civil damages under Civil Code Articles 19, 20, 21, and 26 for abuse of rights, unlawful injury, conduct contrary to morals or public policy, and interference with privacy or family life. (LawPhil)

A private insult sent only to the borrower may not meet the publication element of libel because no third person received it. The same message may still constitute a threat, unjust vexation, an unfair collection practice, or evidence of regulatory misconduct. By contrast, sending the accusation to the borrower’s employer, family group chat, or social-media audience creates third-party publication and a different legal risk.

Common Situations

The app messaged your employer

Legitimate employment verification during the application process is different from telling human resources or co-workers that an employee is delinquent. Disclosure of the debt to embarrass the borrower or pressure the employer is generally inconsistent with confidentiality, proportionality, and fair collection rules.

Preserve the employer’s copy of the message and ask the recipient to identify the sender, date, and phone number. Include the employer’s evidence in both SEC and NPC complaints.

The app posted your photograph with the word “scammer”

Save the complete post before reporting it. A real unpaid balance does not automatically justify publishing the borrower’s photograph or branding the borrower a criminal. The post may support SEC, NPC, civil, or criminal remedies depending on its wording and audience.

The collector says police will arrest you tomorrow

Ask for the case number, court, prosecutor’s office, and official document. Check any claimed summons directly with the named government office rather than through the collector’s contact number. A collection agent cannot issue a warrant or order an arrest.

The app already copied your contacts

Revoking permissions remains useful, but it cannot retrieve data already transferred. Send the written privacy demand, warn affected contacts not to respond or disclose information, and document every new contact after the demand. Continued disclosure after written notice can strengthen the evidence of deliberate misconduct.

The app appears unregistered

Preserve the contract, app-store page, payment beneficiary, disbursement record, and every name used by the collector. Report both the unlicensed operation and collection conduct to the SEC. Do not assume that an unregistered lender’s harassment makes the money received a gift; the validity and enforceability of the financial obligation may require a separate legal determination.

The borrower is an OFW or foreign national

The NPC accepts complaints from foreign nationals whose personal data are processed in the Philippines. A non-resident Filipino who has no Philippine representative may submit a complaint notarized through a Philippine Embassy or Consulate or supported by an apostille from the country of origin. A representative filing for the borrower generally needs a special power of attorney. (National Privacy Commission)

A foreign national signing documents abroad should confirm the NPC’s authentication requirements. Private documents executed in an Apostille Convention country are generally notarized locally and apostilled by the competent authority for use in the Philippines. (Philippine Embassy)

Mistakes That Weaken a Complaint

Uninstalling the app before saving its privacy notice, permissions, agreement, and messages.
Submitting only cropped screenshots without dates, account names, URLs, or context.
Naming only the app brand and not the corporation behind it.
Secretly recording calls without considering RA No. 4200.
Blocking every number before obtaining enough evidence to identify the collector.
Paying a personal e-wallet account without official confirmation or receipt.
Responding with threats, insults, or public accusations.
Assuming that an SEC or NPC complaint automatically erases the debt.
Filing an NPC complaint without first notifying the lender in writing or explaining why that step should be waived.
Using one vague complaint against several unrelated lending companies instead of separating the evidence for each respondent.

Frequently Asked Questions

Can an online lending app contact all my phone contacts?

No. It cannot use the contact list as a public directory for debt collection. A properly consenting guarantor may be contacted. A mere character reference, friend, relative, or co-worker is not automatically responsible for the debt.

Can the lender post my photograph and loan balance on Facebook?

Publicly posting this information to shame or pressure you may violate SEC collection rules, the Data Privacy Act, NPC loan-processing guidelines, and potentially civil or criminal law.

Can a lender contact my barangay?

A lender may use lawful dispute-resolution or legal procedures where applicable, but it should not disclose a debt to barangay officials merely to embarrass the borrower or circulate the information in the community. A fake barangay summons should be verified directly with the barangay office.

Can I go to jail for an unpaid online loan?

Not for ordinary nonpayment alone. The Constitution prohibits imprisonment for debt. Separate criminal acts—such as proven fraud, falsification, identity theft, or a Bouncing Checks Law violation—are different matters.

Should I uninstall the lending app immediately?

Preserve the evidence first. Save the contract, privacy notice, app details, messages, permissions, and payment information. Then revoke unnecessary permissions and uninstall when doing so will not destroy evidence or access to essential account records.

Does reporting harassment cancel my loan?

No. The complaint concerns unlawful collection conduct or data processing. The underlying debt, interest, fees, and enforceability of the contract are separate issues.

What is the quickest way to stop calls to my family?

Send a written demand identifying the specific contacts and stating that they are not guarantors. Revoke app permissions, warn contacts not to engage, and file with the SEC and NPC if contact continues.

What if the lender refuses to identify its company?

Document every available clue: app-store developer, privacy-policy domain, payment account, disbursement source, SMS sender, phone numbers, email addresses, and collector names. Submit these to the SEC and cybercrime authorities for identification.

Can I file complaints with both the SEC and NPC?

Yes, when different issues are involved. The SEC handles unfair collection and regulatory violations by lending or financing companies. The NPC addresses unlawful personal-data processing and disclosure. Criminal threats, fraud, or cybercrime may also be reported to the PNP or NBI.

Can a collection agency blame the lender and the lender blame the agency?

The lender generally remains responsible for collection practices conducted through its outsourced service provider. SEC Memorandum Circular No. 18 treats the third-party collector as the lender’s agent and places ultimate compliance responsibility on the financing or lending company.

Key Takeaways

A valid debt does not give a lender the right to threaten, insult, deceive, or publicly shame the borrower.
Random phone contacts, character references, relatives, employers, and co-workers generally cannot be used as collection targets.
Preserve complete evidence before blocking numbers, reporting posts, or uninstalling the app.
Do not secretly record private calls without considering the Anti-Wiretapping Act.
Send a written demand and allow 15 calendar days for a privacy response unless urgent circumstances justify immediate NPC intervention.
File unfair collection complaints with the SEC, privacy complaints with the NPC, and threats or cybercrime reports with the PNP, NBI, or DICT.
Complaining about harassment does not automatically cancel a valid loan, so continue addressing the balance through documented and lawful channels.