Online lending app harassment can make a borrower feel trapped: collectors threaten to shame you, message your contacts, post your ID, call your employer, or say you will be arrested if you do not pay immediately. In the Philippines, a lender may collect a valid debt, but it cannot use threats, public shaming, abusive language, unlawful disclosure of personal data, or contact-list harassment to force payment. This guide explains what is illegal, what evidence to save, where to complain, and how to protect yourself and your contacts.

The first thing to know: debt collection is allowed, harassment is not

A loan does not disappear just because the lender acted badly. If you borrowed money, the lender may still demand payment, send lawful reminders, negotiate, or file a civil case.

But the method of collection matters.

The 1987 Philippine Constitution states that no person shall be imprisoned for debt. This means a collector’s usual threat of “ipapakulong ka namin dahil hindi ka nagbayad” is misleading when the issue is only non-payment of a loan. Criminal liability may arise only from a separate crime, such as fraud, identity theft, threats, cyber libel, or other punishable conduct—not from mere inability to pay. (Supreme Court E-Library)

Under Republic Act No. 9474, or the Lending Company Regulation Act of 2007, lending companies must be corporations and cannot operate as lending companies without authority from the Securities and Exchange Commission. The SEC also has power to supervise lending companies, require reports, and impose administrative sanctions including suspension, revocation, and fines. (Supreme Court E-Library)

What counts as online lending app harassment in the Philippines?

The clearest legal basis is SEC Memorandum Circular No. 18, Series of 2019, which applies to financing companies, lending companies, and third-party service providers they hire for collection.

The SEC treats the following as unfair debt collection practices:

Harassing act	Common real-life example
Threats of violence or other criminal means	“Pupuntahan ka namin sa bahay mo,” “ipapahiya ka namin,” or threats to harm you or your family
Threats to take action that cannot legally be taken	“May warrant ka na,” “pupulutin ka ng pulis,” or “kakaltasan namin sahod mo” without a lawful order
Obscene, insulting, or profane language	Collectors calling you “scammer,” “magnanakaw,” or using sexual or degrading insults
Disclosure or publication of borrower information	Posting your name, photo, ID, debt, or “wanted” image in group chats or social media
Telling others false or disputed loan information	Messaging relatives, co-workers, neighbors, or Facebook friends about your debt
False representation or deceptive collection methods	Pretending to be police, barangay officials, lawyers, court staff, or NBI agents
Contacting at unreasonable hours	Calling before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exception
Contacting people in your phonebook who are not guarantors or co-makers	Harassing your contacts even if they never agreed to be responsible for your loan

The 2026 public advisory of the DICT, National Privacy Commission, and SEC also specifically warns against online lending platforms that engage in harassment, intimidation, public shaming, and unlawful use of personal data. It reiterates that unnecessary app permissions, excessive contact-list access, processing that leads to harassment, and contacting people other than guarantors for debt collection are prohibited.

Your data privacy rights against online lending apps

Many online lending app harassment cases are really data privacy cases. The app asks for access to contacts, photos, camera, location, storage, SMS, or social media, then uses that access to pressure the borrower.

Republic Act No. 10173, or the Data Privacy Act of 2012, protects personal information and creates rights for data subjects—the people whose information is collected, stored, used, disclosed, or otherwise processed. Consent must be freely given, specific, and informed; the law also gives individuals rights to dispute errors and to suspend, withdraw, block, remove, or destroy personal information that is unlawfully obtained, used for unauthorized purposes, or no longer necessary. (National Privacy Commission)

The National Privacy Commission’s loan-related rules are especially important for lending apps. NPC Circular No. 20-01 covers personal data processing for loan activities, including loan applications, KYC, loan servicing, repayment, debt collection, and remedial measures. It applies to lending and financing companies, persons acting as such, and third-party service providers, whether or not they have SEC authority. (National Privacy Commission)

NPC Circular No. 2022-02 strengthened these rules by requiring consent at the point where the data is necessary and by requiring “just-in-time” notices—clear notices given when the app asks for specific information. (National Privacy Commission)

Contacts are not automatically guarantors

A common abusive tactic is telling your relatives or friends: “You are listed as a reference, so you must pay.”

That is usually wrong.

The 2026 DICT-NPC-SEC advisory explains that online lending platforms must separate character references from guarantors. A character reference is for identification or verification. A guarantor is someone who expressly consented to assume responsibility for the loan in case of default. To be treated as a guarantor, the person must have given consent to be a guarantor.

So if your mother, officemate, friend, employer, or former classmate never signed or agreed to guarantee the loan, collectors generally cannot treat them as responsible for payment.

Can an online lending app post your photo, ID, or debt online?

No, not as a collection tactic.

Publishing your name, face, ID, address, phone number, debt amount, or alleged non-payment in Facebook groups, Messenger group chats, TikTok, Viber, Telegram, or workplace chats may violate several laws depending on the facts:

Possible legal basis	When it may apply
SEC MC No. 18, s. 2019	Disclosure or publication of borrower information to pressure payment
Data Privacy Act of 2012	Unauthorized or excessive processing, disclosure, or use of personal data
Civil Code Articles 19, 20, 21, and 26	Abuse of rights, unlawful damage, acts contrary to morals or public policy, invasion of privacy, humiliation, or disturbance of private life
Revised Penal Code and RA 10175	Threats, unjust vexation, oral defamation, libel, cyber libel, identity theft, or other crimes depending on the act

The Civil Code is useful because not every abusive act is necessarily a crime, but it may still give rise to civil liability. Article 26 specifically protects dignity, personality, privacy, and peace of mind, and recognizes actions for damages, prevention, and other relief for similar acts that disturb private life or humiliate a person. (Supreme Court E-Library)

Immediate steps to stop online lending app harassment

1. Do not panic-pay to a personal account

Collectors often create urgency: “Pay within 10 minutes or we will message all your contacts.” Before paying, check:

Is the payment channel under the company’s official name?
Is the account a personal GCash, Maya, or bank account of an “agent”?
Does the amount match your disclosure statement or loan agreement?
Are they adding unexplained “extension,” “processing,” or “VIP removal” fees?

Paying to an unauthorized personal account can make the problem worse because the app may still treat the loan as unpaid. Save the payment instructions as evidence.

2. Preserve evidence before blocking or deleting

Evidence wins complaints. Save everything before the collector deletes messages or changes names.

Keep:

Screenshots of threatening texts, chats, emails, and social media posts
Full screen captures showing date, time, sender, number, profile name, and URL if available
Call logs showing repeated calls or calls outside reasonable hours
Voice recordings or voicemail, if available
Screenshots from your contacts who received messages
The loan agreement, disclosure statement, repayment schedule, and in-app balance
App name, developer name, website, email, SEC registration claims, and Play Store/App Store listing
Proof of payment, if any
Screenshots of app permissions requested or granted
Your written complaint to the lender or Data Protection Officer

Ask affected contacts to send their screenshots to you without editing them. If possible, ask them to write a short statement: who contacted them, when, what was said, and how they know you.

3. Revoke unnecessary app permissions

On your phone, check app permissions and turn off access to contacts, photos, camera, microphone, location, SMS, and storage if they are not necessary. The 2026 government advisory says unnecessary processing through mobile apps, including unnecessary permissions, is prohibited, and that borrowers should review permissions because they must be needed for specified and legitimate purposes.

If the harassment is ongoing, consider:

Revoking permissions first
Taking screenshots of the permissions screen
Uninstalling the app after preserving evidence
Changing passwords for email, social media, and e-wallets
Enabling two-factor authentication
Warning close contacts not to respond to collectors or send money

4. Send a short written demand to stop harassment

A written notice helps create a paper trail, especially for the NPC’s exhaustion-of-remedies requirement.

Keep it short and factual:

I dispute your unlawful collection methods. Stop contacting my relatives, friends, employer, and other third parties who are not guarantors or co-makers. Stop disclosing my personal information and loan information. Communicate with me only through my registered number/email and only at reasonable hours. I also request your Data Protection Officer’s contact details and a copy of all personal data you processed, the source of such data, and the recipients to whom you disclosed it.

Send this through email, in-app support, chat, or any official channel you can document.

5. File with the correct agency

Different agencies handle different parts of the problem. You may file with more than one agency if the facts overlap.

Problem	Main office to approach	What they can address
Unfair debt collection by lending or financing company	SEC Financing and Lending Companies Department through SEC iMessage	Harassment, unfair collection, unauthorized lending activity, administrative sanctions
Misuse of contacts, IDs, photos, or personal data	National Privacy Commission	Data privacy violations, unauthorized processing/disclosure, civil damages, administrative sanctions, possible DOJ referral
Threats, scams, identity theft, cyber libel, hacking, impersonation	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Criminal investigation and case build-up
General cyber hotline reporting	DICT Cyber Hotline	Reporting channel for cyber-related concerns
Local safety concern	Police station or barangay blotter	Incident record, immediate safety documentation, local assistance

The 2026 DICT-NPC-SEC advisory identifies SEC FINLEND for unfair debt collection complaints through the SEC iMessage portal and lists the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group for harassment, threats, fraud, and scams.

How to file a complaint with the SEC against an online lending app

Use the SEC when the issue is unfair debt collection, abusive collection agents, misleading threats, undisclosed charges, or lending without proper authority.

Step-by-step SEC complaint preparation

Identify the respondent. Write the app name, company name, website, phone numbers, email addresses, and agent names if known.
Check if the company claims to be registered. Save screenshots of its website, app page, loan agreement, disclosure statement, and SEC registration claims.
Write a chronological statement. List events by date and time: application, approval, due date, first threat, messages to contacts, public posts, calls outside permitted hours.
Attach evidence. Label each screenshot or document as Annex A, Annex B, Annex C, and so on.
State the violations clearly. Mention threats, insults, disclosure of personal information, contacting non-guarantors, false threats of arrest, or unreasonable-hour calls.
File through the SEC iMessage portal. The SEC iMessage page allows users to open a new ticket and check ticket status. (imessage.sec.gov.ph)
Keep the ticket number. Follow up using the reference number and submit additional screenshots if harassment continues.

The SEC has previously instructed complainants filing against lending or financing companies to follow the complaint instructions carefully and use a subject line identifying the complainant, respondent company, and subject of complaint. (www.foi.gov.ph)

How to file a complaint with the National Privacy Commission

Use the NPC when the lending app accessed or used your personal data improperly, such as:

Contacting people from your phonebook
Posting your photo, ID, address, workplace, or debt online
Sending your loan details to relatives, friends, co-workers, or employers
Using excessive permissions not necessary for the loan
Refusing to correct, remove, or stop unauthorized processing of your data

NPC filing requirements in practice

The NPC says complaints may be filed by the affected data subject, an authorized representative with a special power of attorney, or the NPC on its own initiative. A complaint is filed using a filled-out and notarized complaint-assisted form or a verified complaint, with evidence and witness affidavits, through personal filing, registered mail, courier, or authorized email. (National Privacy Commission)

The NPC also requires exhaustion of remedies. This means you should first inform the respondent in writing about the privacy violation and give it a chance to address the matter. If there is no response within 15 calendar days from receipt, or the response is not timely or appropriate, attach proof of your written notice to the NPC complaint. (National Privacy Commission)

A strong NPC complaint usually includes:

Document	Purpose
Notarized complaint form or verified complaint	Formal statement of your complaint
Valid ID	Confirms identity of complainant
Written notice to the lender or DPO	Shows exhaustion of remedies
Proof of sending and receipt	Email sent page, ticket number, courier receipt, or chat timestamp
Screenshots from you and affected contacts	Shows unauthorized disclosure or harassment
App permission screenshots	Shows excessive access requested or used
Witness affidavits	Supports third-party contact or public shaming
Loan documents	Shows respondent, app, account, and transaction context

If the NPC upholds a complaint, the case records may go to its Enforcement Division for civil damages, fines, and administrative sanctions when appropriate. If criminal charges appear warranted, the NPC may forward the case record to the Department of Justice and recommend prosecution. (National Privacy Commission)

When to go to PNP ACG, NBI Cybercrime Division, or the prosecutor

Go beyond SEC or NPC if the collector’s conduct involves possible crimes, such as:

Threats of harm
Extortion or “pay now or we will post you”
Fake warrants, fake subpoenas, or impersonation of police/court staff
Use of your ID or photos to create fake posts
Hacking or unauthorized account access
Cyber libel or public accusations online
Identity theft
Fraudulent loan apps that demand advance fees before releasing a loan

Republic Act No. 10175, the Cybercrime Prevention Act of 2012, covers cybercrime offenses including illegal access, data interference, computer-related fraud, computer-related identity theft, and cyber libel. The DOJ rules implementing RA 10175 identify the NBI and PNP as law enforcement authorities responsible for cybercrime enforcement. (Supreme Court E-Library)

Computer-related identity theft includes intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another without right. (Supreme Court E-Library)

Cyber libel applies to libel committed through a computer system or similar means, but the implementing rules note that liability applies to the original author of the post, not merely those who receive or react to it. (Supreme Court E-Library)

For criminal complaints, prepare a complaint-affidavit, evidence, witness statements, IDs, and a clear timeline. The DOJ’s filing guide for preliminary investigation lists an investigation data form, complaint-affidavit or sworn statement, and supporting documents as basic requirements. (Department of Justice Philippines)

Should you still pay the loan?

Separate the debt from the harassment.

If the loan is legitimate and you received the money, you may still owe the principal and lawful charges. But you should not be forced to pay illegal, unexplained, or inflated amounts through harassment.

Practical steps:

Ask for a written computation of principal, interest, penalties, fees, and payments made.
Compare it with the disclosure statement and loan agreement.
Pay only through official channels under the company name.
Save proof of every payment.
Avoid “extension fees” that do not reduce principal unless the agreement clearly explains them.
If you dispute the amount, state the dispute in writing.
Do not admit to false facts, fake fraud allegations, or criminal accusations just to stop the calls.

Under RA 9474, lending companies may agree with borrowers on loan amounts and reasonable interest rates and charges, but the agreement must comply with the Truth in Lending Act and the Consumer Act. (Supreme Court E-Library)

Common mistakes that weaken harassment complaints

Deleting the app too early

Deleting the app may remove access to transaction history, disclosure statements, in-app messages, and account details. Capture evidence first.

Sending emotional replies

It is understandable to be angry, but abusive replies can distract from your complaint. Keep messages short, factual, and firm.

Filing only a social media post

Public posting may warn others, but it is not a substitute for SEC, NPC, PNP, NBI, or prosecutor filings. A regulator needs evidence, respondent details, and a clear timeline.

Forgetting the 15-day NPC written notice

For privacy complaints, the NPC may dismiss or refuse to act on complaints where the complainant did not first give the respondent a written chance to address the issue, unless an exception applies. (National Privacy Commission)

Not getting screenshots from contacts

If the harassment happened to your contacts, your own phone may not show the most important proof. Ask the recipient to screenshot the full message, sender, date, and time.

Paying collectors through personal accounts

If an “agent” says to pay a personal e-wallet, request an official company payment channel. Save the demand as evidence.

What if you are a Filipino abroad or a foreigner dealing with a Philippine lending app?

You can still document and complain if the lending app, borrower, personal data processing, or harmful conduct has a Philippine connection.

The Data Privacy Act has extraterritorial provisions. It may apply to acts done inside or outside the Philippines when the processing relates to personal information about a Philippine citizen or resident, or when the entity has links with the Philippines, such as carrying on business in the country or collecting/holding personal information in the Philippines. (National Privacy Commission)

If you are abroad and need to file notarized papers, check the agency’s current form requirements. NPC Circular 2024-01 recognizes complaints filed by persons abroad, but states that the complaint must be notarized by the Philippine Embassy or Consulate or carry an apostille certificate from the country of origin. (National Privacy Commission)

For foreigners in the Philippines, the practical process is usually the same: preserve evidence, identify the Philippine entity or app, file with the SEC for unfair collection, file with the NPC for data privacy violations, and go to PNP/NBI if threats, cybercrimes, or scams are involved.

Sample evidence checklist

Evidence	Why it matters
Loan agreement or disclosure statement	Shows the actual terms and respondent
Screenshot of app profile or store listing	Links the app to a developer or company
SEC registration or authority claims	Helps SEC verify whether the company is authorized
Threatening messages	Proves unfair collection or possible criminal threats
Messages sent to contacts	Proves contact-list harassment and privacy violation
Public posts or group chats	Proves publication or shaming
App permission screen	Shows excessive or unnecessary access
Written demand to stop harassment	Shows you objected and requested correction
DPO or customer support response	Shows whether the company acted or ignored you
Police/barangay blotter	Helps document urgent safety incidents
Payment receipts	Prevents false claims of non-payment

Frequently Asked Questions

Can an online lending app message my contacts in the Philippines?

Generally, not for debt collection unless the person is a guarantor or co-maker who actually consented to that role. A character reference is not automatically responsible for your debt. The 2026 DICT-NPC-SEC advisory states that contacting people in the borrower’s contact list other than guarantors is prohibited for debt collection.

Can I be arrested for not paying an online loan?

Not for mere non-payment of debt. The Constitution prohibits imprisonment for debt. However, a separate criminal act—such as fraud, identity theft, threats, or cybercrime—can be investigated if supported by evidence. (Supreme Court E-Library)

Where do I report online lending app harassment?

Report unfair debt collection to the SEC through SEC iMessage. Report misuse of contacts, IDs, photos, or personal data to the NPC. Report threats, scams, hacking, impersonation, identity theft, or cyber libel to PNP ACG or NBI Cybercrime Division. The 2026 joint advisory lists these channels for abusive online lending conduct.

Do I need a lawyer to file with SEC or NPC?

For many administrative complaints, ordinary borrowers file on their own using forms, affidavits, screenshots, and a clear timeline. The NPC requires a notarized complaint-assisted form or verified complaint with evidence and witness affidavits. (National Privacy Commission)

What if the online lending app is not registered with the SEC?

Include that in your SEC complaint. Under RA 9474, no lending company may conduct business unless it has authority to operate from the SEC, and violations may lead to fines, imprisonment, or both depending on the offense and court action. (Supreme Court E-Library)

Can I sue for damages if they posted my face or messaged my employer?

Possibly, depending on evidence and harm suffered. Aside from SEC and NPC remedies, Civil Code Articles 19, 20, 21, and 26 may support a civil claim for damages where a person abuses rights, violates law, acts contrary to morals or public policy, invades privacy, or humiliates another. (Lawphil)

Should I block the collector?

You may block abusive numbers after preserving evidence. Keep at least one documented communication channel open if you are negotiating or requesting a statement of account. If threats continue from new numbers, keep saving screenshots and update your complaint.

What if the app already deleted its messages?

Use whatever remains: call logs, notifications, screenshots from contacts, emails, payment records, app listings, and your written timeline. Ask affected contacts to preserve their copies. Deleted messages may still be supported by witness affidavits and other circumstantial evidence.

Is it legal for collectors to call late at night?

SEC MC No. 18 treats contact before 6:00 a.m. or after 10:00 p.m. as an unfair collection practice, subject to the circular’s limited exception. Save call logs showing date and time.

Key Takeaways

A lender may collect a valid debt, but it cannot threaten, shame, deceive, or harass you.
Mere non-payment of a loan is not a ground for imprisonment in the Philippines.
Contacting your phonebook, employer, friends, or relatives for debt collection is generally unlawful unless they are actual guarantors or co-makers.
Save screenshots, call logs, app permissions, loan documents, payment receipts, and messages sent to your contacts.
File unfair collection complaints with the SEC and data privacy complaints with the NPC.
Go to PNP ACG, NBI Cybercrime Division, or the prosecutor when there are threats, impersonation, identity theft, hacking, scams, or cyber libel.
Pay only through official company channels and keep proof of payment.
For NPC complaints, send a written notice to the lender or its Data Protection Officer first and attach proof if there is no proper response within 15 calendar days.