Online lending app harassment can feel terrifying because the messages are designed to shame, panic, and isolate you. In the Philippines, however, collectors are not allowed to use threats, public shaming, fake legal notices, or your contact list to force payment. Even if you really owe money, the lender must collect within legal limits. This guide explains what counts as illegal SMS harassment, which Philippine laws protect you, what evidence to save, and where to report online lending app abuse to the SEC, NPC, NTC, PNP, NBI, or court depending on what happened.

What Counts as SMS Harassment by an Online Lending App?

SMS harassment usually involves repeated text messages, calls, chat messages, or social media posts from a lending app, collector, or unknown number connected to a loan. Some messages are merely annoying. Others may violate data privacy, consumer protection, debt collection, cybercrime, or criminal laws.

Common examples include:

“Pay today or we will post your face as a scammer.”
“We already sent your debt to your employer and relatives.”
“You will be arrested today if you do not pay.”
“Your contacts will know you are a thief.”
Group chats where your photo, ID, address, or loan details are shared.
Messages to your parents, spouse, boss, co-workers, or friends even if they are not guarantors.
Calls or texts very late at night or very early in the morning.
Fake court, police, barangay, NBI, or prosecutor notices.
Collectors using insults, threats, profanity, or sexual humiliation.
Collectors demanding payment from a “character reference” who never agreed to be a guarantor.

The important point is this: a debt does not give a lender permission to humiliate you, threaten you, or misuse your personal data.

Your Main Legal Rights Against Online Lending App Harassment

Several Philippine laws and regulations may apply at the same time. The correct remedy depends on the conduct.

1. SEC rules on unfair debt collection

The Securities and Exchange Commission regulates lending companies and financing companies under laws such as the Lending Company Regulation Act of 2007, or Republic Act No. 9474, and the Financing Company Act of 1998, or Republic Act No. 8556. RA 9474 declares the State policy to regulate lending companies and prevent practices prejudicial to public interest, while RA 8556 gives the SEC authority over financing companies and requires authority before a company may hold itself out as a financing company. (Lawphil)

The most important SEC issuance for harassment is SEC Memorandum Circular No. 18, Series of 2019, titled Prohibition on Unfair Debt Collection Practices of Financing Companies and Lending Companies. It applies not only to the lending or financing company itself, but also to third-party service providers or collection agents hired by them. The circular states that lenders may use only reasonable and legally permissible collection methods and must act in good faith and reasonable conduct.

Under SEC MC No. 18, unfair collection practices include:

Threats of violence or other criminal means to harm a person, reputation, or property.
Threats to take action that cannot legally be taken.
Obscene, insulting, or profane language.
Disclosure or publication of names and personal information of borrowers who allegedly refuse to pay, except as allowed by the circular.
Communicating false loan information, including falsely saying the debt is disputed.
False representation or deceptive means to collect a debt.
Contact before 6:00 a.m. or after 10:00 p.m., except under limited circumstances.
Contacting people in the borrower’s contact list other than those named as guarantors or co-makers.

For violations, SEC MC No. 18 provides administrative penalties. For lending companies, the first offense is ₱25,000 and the second offense is ₱50,000. For financing companies, the first offense is ₱50,000 and the second offense is ₱100,000. A third offense may result in heavier penalties, suspension, or revocation of the company’s authority to operate, depending on the facts and gravity of the violation.

2. Data Privacy Act protections

The Data Privacy Act of 2012, or Republic Act No. 10173, protects personal information such as your name, mobile number, address, photo, contacts, employer, ID details, and loan-related information. The law requires lawful processing of personal data and gives data subjects rights such as the right to be informed and the right to block, remove, or destroy personal data that is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary. (National Privacy Commission)

RA 10173 also penalizes unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure of personal or sensitive personal information. For example, unauthorized processing of personal information may be punished by imprisonment and a fine, while unauthorized disclosure of sensitive personal information carries heavier penalties. (National Privacy Commission)

For online lending apps, the National Privacy Commission has specifically warned that lenders are prohibited from harvesting phone and social media contact lists to harass delinquent borrowers. (National Privacy Commission)

3. NPC rules on loan-related personal data

The NPC issued NPC Circular No. 20-01 on processing personal data for loan-related transactions and later amended it through NPC Circular No. 2022-02. These rules cover personal data used for loan applications, loan approval, collection, account closure, character references, and guarantors. The NPC explained that the amendments were meant to address data privacy concerns caused by online lending. (National Privacy Commission)

Under the amended NPC rules:

Lending and financing companies must give clear “just-in-time” notices before getting consent.
Apps must avoid unnecessary permissions involving personal or sensitive personal information.
Access to contact information must not be unbridled, excessive, or disproportionate.
Processing that leads to harassment, debt collection outside guarantors, or unfair collection practices is prohibited.
A character reference is not automatically a guarantor.
A guarantor must give separate consent.
For debt collection, lenders are prohibited from contacting people in the borrower’s contact list other than declared guarantors.
Lenders must register with the NPC and submit a list of publicly available apps they own and operate. (National Privacy Commission)

In 2026, the DICT, NPC, and SEC also issued a public advisory on online lending platforms reiterating that unnecessary app permissions, excessive access to contact lists, harassment, public shaming, and contacting non-guarantor contacts are prohibited. The advisory specifically states that, for debt collection, lending and financing companies may only contact the guarantor.

4. Financial consumer protection

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765 of 2022, protects financial consumers and recognizes rights such as equitable and fair treatment, disclosure and transparency, data privacy and protection, and timely handling and redress of complaints. It covers financial products and services, including digital financial products and services, and identifies the BSP, SEC, Insurance Commission, and Cooperative Development Authority as financial regulators. (Supreme Court E-Library)

For online lending app harassment, RA 11765 matters because abusive collection is not just a private dispute over money. It can also be a financial consumer protection problem involving unfair treatment, abusive market conduct, misleading statements, or failure to handle complaints properly.

5. Civil Code rights to dignity, privacy, and damages

Even if a particular act does not immediately result in a criminal conviction, the borrower or affected person may have a civil claim for damages.

The Civil Code of the Philippines provides:

Article 19: every person must act with justice, give everyone his due, and observe honesty and good faith.
Article 20: a person who, contrary to law, willfully or negligently causes damage to another must indemnify the injured person.
Article 21: a person who willfully causes loss or injury in a manner contrary to morals, good customs, or public policy must compensate the injured person. (Lawphil)
Article 26: every person must respect the dignity, personality, privacy, and peace of mind of others; acts that disturb private life, cause humiliation, or invade privacy may produce a cause of action for damages, prevention, and other relief. (Supreme Court E-Library)

These provisions are useful when collectors humiliate a borrower in group chats, message an employer, spread debt information to relatives, or publish personal details.

6. Possible criminal and cybercrime issues

Some online lending harassment may also fall under the Revised Penal Code or Cybercrime Prevention Act of 2012, or Republic Act No. 10175.

Possible offenses include:

Conduct	Possible legal basis
Threatening to harm, kill, injure, or destroy property	Grave threats under Article 282 of the Revised Penal Code
Using violence, threats, or intimidation to force payment	Grave coercion under Article 286 of the Revised Penal Code
Repeated acts meant to annoy, distress, or disturb	Unjust vexation under Article 287 of the Revised Penal Code, depending on facts
Posting that someone is a scammer, thief, criminal, or prostitute without basis	Libel under Articles 353 and 355 of the Revised Penal Code; cyber libel under RA 10175 if done online
Accessing, using, or disclosing personal data without authority	Possible Data Privacy Act violation
Fake links, fake fees, fake agencies, phishing, or identity theft	Possible cybercrime, fraud, or estafa-related complaint

Article 282 of the Revised Penal Code penalizes grave threats involving threats to inflict a wrong amounting to a crime, while Article 286 penalizes grave coercion committed through violence, threats, or intimidation. (Supreme Court E-Library) RA 10175 defines and penalizes cybercrimes and may apply when threats, libelous statements, or fraudulent acts are committed through computer systems, social media, messaging apps, or other electronic means. (Lawphil)

What to Do Immediately When Harassment Starts

The first goal is to stop the harm, preserve evidence, and avoid making the situation worse.

1. Do not delete the messages

Save everything, even if the messages are embarrassing. Screenshots should show:

Sender’s number, username, or profile name.
Date and time.
Full message thread, not only one isolated text.
Any attached photo, ID, edited image, fake warrant, fake subpoena, or group chat.
Call logs showing repeated calls.
Names of people contacted by the collector.
Proof that the contacted person was not your guarantor or co-maker.

For group chats, take screenshots showing the members, the collector’s statements, the shared photos or personal data, and the date/time. If possible, ask affected contacts to send you screenshots from their own phones.

2. Record the lender’s identity

Write down:

App name.
Company name shown in the loan agreement, disclosure statement, app, website, SMS, or payment channel.
SEC registration number and Certificate of Authority number, if shown.
Collector’s name, alias, mobile number, email, or social media account.
Payment account names, GCash/Maya numbers, bank accounts, or QR codes used.
Loan amount, amount received, due date, fees, interest, penalties, and amount being demanded.

Many borrowers only know the app name, but the regulator usually needs the legal company name. Check your loan disclosure, app profile, SMS footer, privacy notice, or payment instructions.

3. Stop giving unnecessary permissions

If the app still has access to your phone:

Go to your phone settings.
Open App Permissions.
Remove access to contacts, photos, SMS, call logs, camera, microphone, and location unless still needed for a legitimate purpose.
Take screenshots of the permissions before and after changing them.
Do not uninstall the app until you have saved loan documents, privacy notices, and evidence.

The 2026 DICT-NPC-SEC advisory states that online lending platforms must not request unnecessary permissions and must prompt users to revoke permissions once the purpose has been fulfilled. It also says unbridled processing of contact lists is prohibited.

4. Send one clear written objection

Send a calm message to the app’s official customer service channel and, if available, the collector:

I am disputing and reporting your collection conduct. Do not contact my relatives, employer, friends, character references, or any person who is not my guarantor or co-maker. Do not disclose my personal data, loan details, photo, ID, address, or contact information to third parties. Communicate only through my registered number/email and only within reasonable hours. Preserve all records of your collection activity.

Do not argue repeatedly. Do not insult the collector. The purpose is to create a written record that you objected to the harassment and unauthorized disclosure.

5. Warn your contacts briefly

A short message is enough:

I am being harassed by a loan app/collector. You may receive false or embarrassing messages about me. Please do not engage. Kindly screenshot the message, number, date, and time, then send it to me for evidence.

This helps preserve proof and prevents panic.

Where to File Complaints in the Philippines

Different offices handle different parts of the problem. In serious cases, you may file with more than one agency.

Situation	Where to report	Main purpose
Abusive debt collection by a lending or financing company	SEC	Administrative action, fines, suspension, revocation, regulatory enforcement
Misuse of contacts, photos, IDs, personal data, or loan details	NPC	Data privacy complaint, investigation, data protection orders, penalties
Scam texts, spam texts, or threatening SMS numbers	NTC	Blocking or endorsement to telcos and agencies
Threats, cyber libel, fake posts, identity theft, extortion, fraud	PNP Anti-Cybercrime Group, NBI Cybercrime Division, DOJ Office of Cybercrime	Criminal investigation
Immediate physical danger	Local police station or emergency authorities	Safety, blotter, police action
Civil damages for humiliation, privacy invasion, or reputational harm	Proper court	Damages and civil relief

The 2026 DICT-NPC-SEC advisory identifies the SEC Financing and Lending Companies Department as the office for unfair debt collection complaints and lists the SEC iMessage portal for submission. It also identifies the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group for other harassment, threats, fraud, or scams.

How to File a Complaint with the SEC

The SEC is usually the first stop when the harassment comes from a lending company, financing company, online lending platform, or collector acting for them.

The SEC’s iMessage SEC-Wide Ticketing System is the SEC’s official web-based platform for public inquiries, complaints, incidents, and requests. It generates an electronic ticket and allows users to track submissions. (Securities and Exchange Commission)

Steps

Prepare your evidence file:
- Government ID.
- Loan agreement or disclosure statement.
- Screenshots of harassment.
- Call logs.
- Proof of messages sent to third parties.
- Proof the third party was not a guarantor or co-maker.
- App name and company details.
- Payment receipts, if any.
Organize screenshots by date:
- Use filenames such as 2026-03-10_SMS_Threat_CollectorNumber.jpg.
- Put the worst violations first: threats, public shaming, contact-list harassment, fake legal notices.
Write a clear complaint narrative:
- When you borrowed.
- Amount released.
- Due date.
- What the collector did.
- Who was contacted.
- What personal data was disclosed.
- What relief you are requesting: investigation, order to stop harassment, sanctions, and preservation of records.
Submit through SEC iMessage and keep the ticket number.
Follow up through the same ticket instead of filing many duplicate complaints.

Practical tips

The SEC complaint is stronger if you identify the legal company name, not only the app name.
If the app is unregistered, say so, but still attach proof of the app, payment channel, and messages.
If collectors used multiple numbers, list them in a table.
If your employer or relatives were contacted, include their sworn statements if available.

How to File a Complaint with the NPC

File with the National Privacy Commission when the issue involves personal data misuse, such as contact list harvesting, sending your loan details to others, posting your photo or ID, or using your character references for debt collection.

The NPC requires a formal complaint in a specific format. Its complaint page says the complainant should download the form, print and fill it out, have it notarized, and submit it in person, by courier, or by scanned email to the NPC. (National Privacy Commission) The NPC also announced that a new Complaint-Affidavit template took effect on July 1, 2025, and that the previous version would no longer be accepted after the transition period. (National Privacy Commission)

What to prepare for the NPC

Document or evidence	Why it matters
Notarized NPC Complaint-Affidavit	Formal basis of the privacy complaint
Government ID	Identifies the complainant
Screenshots of messages	Shows unauthorized disclosure, threats, or harassment
Proof of contact-list misuse	Shows that non-guarantors were contacted
Privacy notice, consent screen, or app permissions	Shows what the app claimed it could access
Loan documents	Shows the relationship and whether a person was a borrower, character reference, guarantor, or co-maker
Statements from affected contacts	Confirms that third parties received your personal data
Proof of request to stop processing	Shows you objected and requested removal/blocking

What to emphasize

For NPC complaints, focus on data privacy facts:

What personal data was accessed?
Was access necessary for the loan?
Did the app access your contacts?
Were non-guarantors contacted?
Were your photo, ID, address, employer, or loan details shared?
Did the lender give a clear privacy notice?
Did you withdraw consent or object?
Did the collector continue anyway?

Reporting SMS Numbers to the NTC

If the harassment comes through SMS or scam-like text messages, the National Telecommunications Commission may receive text scam, spam, or threatening-message reports. NTC guidance through FOI responses directs complaints on text scam, text spam, and illegal or threatening messages to its text spam/scam reporting channel, and another NTC response states that users may report through the NTC text spam/scam report page, consumer email, hotline, or regional office. (www.foi.gov.ph)

NTC reporting is useful for number blocking or telco endorsement, but it does not replace SEC, NPC, PNP, or NBI action when the issue involves debt collection abuse, privacy violations, threats, or fraud.

When to Go to the PNP, NBI, or DOJ Office of Cybercrime

Go to law enforcement when the messages involve:

Threats of physical harm.
Threats to post sexual, edited, or humiliating images.
Fake warrants, fake subpoenas, or fake police/NBI notices.
Extortion.
Identity theft.
Cyber libel or public online shaming.
Use of hacked accounts or fake profiles.
Fraudulent advance fees or phishing links.

The DOJ Office of Cybercrime provides contact information for cybercrime concerns, and the 2026 DICT-NPC-SEC advisory lists NBI Cybercrime Division and PNP Anti-Cybercrime Group contact channels for harassment, threats, frauds, or scams involving online lending platforms. (Cybercrime Division)

For criminal complaints, expect to provide:

Valid ID.
Printed screenshots.
Digital copies of screenshots.
Phone number or account used by the offender.
Link to the post or profile, if online.
Affidavit or sworn statement.
Witness statements, if third parties were contacted.
Device used, if forensic examination is needed.

A police blotter can help document urgent threats, but for cyber-related evidence, specialized cybercrime units are usually better equipped to evaluate screenshots, links, accounts, headers, metadata, and account preservation requests.

Can You Stop Paying the Loan Because of Harassment?

Harassment does not automatically erase a valid loan. If you borrowed money and the lender is legitimate, the principal obligation may still exist. However, you may dispute:

Illegal or undisclosed charges.
Excessive penalties.
Amounts not shown in the disclosure statement.
Collection fees not agreed upon.
Interest or fees that violate applicable rules.
Payments not credited.
Harassment and unauthorized disclosure.

A practical approach is to separate the issues:

Debt issue: How much is legally due?
Collection issue: Did they collect lawfully?
Privacy issue: Did they misuse your personal data?
Criminal issue: Did they threaten, defame, extort, or scam you?

Paying under threat may stop some messages temporarily, but it may also encourage repeated demands. If you pay, keep receipts and pay only through verified official channels.

Common Mistakes That Weaken Complaints

Deleting screenshots or losing the phone

Screenshots and call logs are often the strongest evidence. Back them up immediately to cloud storage, email, or another device.

Posting the collector’s personal information online

It is understandable to feel angry, but publicly posting a collector’s face, number, or private details can create new legal problems. Use the information in formal complaints instead.

Sending threats back

Do not reply with insults, threats, or defamatory statements. Your messages may be used against you.

Filing only with the wrong agency

If the issue is unfair collection, file with the SEC. If the issue is data misuse, file with the NPC. If there are threats or cyber libel, go to PNP/NBI/DOJ. If the issue is SMS blocking, report to the NTC. Many cases need more than one route.

Not distinguishing character reference from guarantor

A character reference is usually provided for identity or verification. A guarantor is someone who separately and expressly agrees to answer for the debt if the borrower defaults. The NPC has made clear that a character reference is not automatically a guarantor and that a guarantor must give separate consent. (National Privacy Commission)

Ignoring fake legal threats

Collectors often say “case filed,” “warrant issued,” or “police will arrest you today.” Ordinary unpaid debt is generally civil in nature. Arrest requires a lawful criminal process, not a collector’s text message. But if the lender alleges fraud, identity theft, or bouncing checks, the facts must be reviewed carefully.

Sample Evidence Log for Online Lending App Harassment

Use a simple table like this when preparing your complaint:

Date and time	Sender	Platform	What happened	Evidence file
March 5, 2026, 8:45 p.m.	09XX-XXX-XXXX	SMS	Threatened to message my employer	Screenshot 01
March 6, 2026, 7:10 a.m.	Collector “Mark”	Viber	Sent my loan details to my sister	Screenshot 02; sister’s statement
March 6, 2026, 11:35 p.m.	Unknown number	SMS	Called me “scammer” and threatened public posting	Screenshot 03
March 7, 2026, 9:00 a.m.	Facebook account	Messenger group chat	Posted my photo and loan amount in a group chat	Screenshot 04; group link

This format helps regulators see the pattern quickly.

Practical Timelines and Bottlenecks

Timelines vary depending on the completeness of your complaint, the number of respondents, and whether the company is registered, reachable, or hiding behind multiple app names.

Process	Typical practical reality
Gathering evidence	Same day to 1 week, depending on how many contacts were messaged
SEC ticket submission	Can be filed online; follow-up depends on docketing and department action
NPC complaint	Requires correct form and notarization; incomplete affidavits can delay acceptance
NTC SMS report	Faster for number reporting, but blocking depends on telco coordination and verification
PNP/NBI cybercrime complaint	May require personal appearance, sworn statement, and digital evidence review
Court case for damages or criminal complaint	Usually longer; evidence quality and respondent identity are critical

Common bottlenecks include:

The app name is different from the legal company name.
The collector uses prepaid numbers or fake profiles.
Screenshots do not show date, time, or sender.
The borrower deleted the app before saving the loan agreement.
The complaint is emotional but lacks a clear timeline.
The person contacted was called a “reference,” but the complaint does not show they were not a guarantor.
The borrower files with NPC but does not notarize the complaint-affidavit.
The lender is unregistered or foreign-operated, making enforcement more difficult.

What If You Are a Foreigner or an OFW?

Foreigners and Filipinos abroad can still be affected by Philippine online lending app harassment, especially if the lender, borrower, contacts, or data processing is connected to the Philippines.

Practical points:

If you are abroad, preserve Philippine SMS messages, Viber/WhatsApp/Messenger screenshots, and payment records.
For notarized complaints, ask the receiving agency whether consular notarization, apostille, or local notarization is acceptable for your situation.
If you need to submit documents executed abroad for Philippine proceedings, authentication may be required depending on the document, country, and forum.
If your Philippine relatives are being harassed, they should preserve their own screenshots and may file separate complaints if their personal data was misused.
If your employer abroad is contacted, document the exact message because it may support damages, privacy, or reputational harm.

Frequently Asked Questions

Can an online lending app text my contacts in the Philippines?

For debt collection, lending and financing companies may not contact people in your contact list unless they are named guarantors or co-makers. NPC guidance also says a character reference is not automatically a guarantor and that guarantors must give separate consent.

Is it legal for a loan app to access my phone contacts?

Access must be lawful, necessary, proportionate, and clearly explained. The NPC has said online lenders are prohibited from harvesting phone and social media contact lists to harass borrowers, and the 2026 DICT-NPC-SEC advisory says unbridled processing of contact lists is prohibited. (National Privacy Commission)

Can collectors call or text me at night?

SEC MC No. 18 treats contact before 6:00 a.m. or after 10:00 p.m. as an unfair collection practice, subject to limited exceptions. A 2025 Philippine Information Agency report also quoted SEC guidance that calls from 10:01 p.m. to 5:59 a.m. to demand payment are considered unfair collection practice.

Can I report the lending app even if I still owe money?

Yes. A valid debt does not authorize threats, insults, public shaming, unlawful disclosure, or contact-list harassment. You can dispute the collection method while separately addressing the legitimate amount, if any, that remains due.

What if the collector says I will be arrested for nonpayment?

Unpaid debt by itself is generally not a basis for immediate arrest. Be careful, however, if there are allegations of fraud, identity theft, falsified documents, or bouncing checks. Save the threat and verify through official court, prosecutor, police, or NBI channels instead of relying on the collector’s message.

What if my relatives or employer received messages?

Ask them not to engage. Have them screenshot the messages showing sender, date, time, and full content. Their evidence can support an SEC complaint for unfair collection, an NPC complaint for unauthorized disclosure or misuse of personal data, and possibly a civil or criminal complaint depending on the wording.

Should I uninstall the loan app?

First save your loan agreement, disclosure statement, privacy notice, app permissions, payment history, and messages. Then remove unnecessary permissions. Uninstalling too early may destroy useful evidence.

Where should I file first: SEC or NPC?

File with the SEC if the main issue is abusive debt collection. File with the NPC if the main issue is misuse of personal data, contact harvesting, or unauthorized disclosure. File with both if both issues are present.

Can I sue for damages?

Possible civil bases include Civil Code Articles 19, 20, 21, and 26, especially if the harassment caused humiliation, reputational damage, loss of employment opportunity, family conflict, anxiety, or other provable injury. Strong documentation is essential.

What if the online lending app is not registered?

Still document and report it. The SEC can act against unauthorized lending or financing activity, while the NPC, NTC, PNP, NBI, or DOJ may handle data privacy, telecommunications, cybercrime, fraud, or threat-related aspects.

Key Takeaways

Online lending apps cannot use harassment, threats, public shaming, or contact-list abuse to collect debt.
SEC MC No. 18 prohibits unfair debt collection, including threats, insults, disclosure of borrower information, unreasonable-hour contact, and contacting non-guarantor contacts.
The Data Privacy Act and NPC loan-related data rules protect borrowers, character references, guarantors, and other contacts from excessive or unauthorized processing.
A character reference is not automatically liable for the loan.
Save screenshots, call logs, app permissions, loan documents, and messages sent to your contacts.
Report unfair collection to the SEC, data misuse to the NPC, SMS abuse to the NTC, and threats, fraud, cyber libel, or extortion to the PNP, NBI, or DOJ cybercrime channels.
Harassment does not automatically cancel a valid debt, but it can expose the lender, app operator, or collector to administrative, civil, data privacy, or criminal liability.