If an online lending app keeps sending threatening SMS messages, texting your contacts, calling your employer, or shaming you over a loan, the most important thing to know is this: owing money does not give a lender the right to harass you, threaten you, or misuse your personal data. Philippine law allows legitimate debt collection, but it must be done lawfully, fairly, and with respect for your privacy. This guide explains what counts as illegal SMS harassment, what laws protect you, what evidence to save, where to complain, and how to make your complaint strong enough for the SEC, NPC, police, or prosecutors to act.

What Counts as SMS Harassment by an Online Lending App?

SMS harassment usually happens when a lending app, financing company, lending company, or third-party collection agent uses pressure tactics that go beyond lawful collection.

Common examples include:

Repeated threatening texts such as “Ipapakulong ka namin,” “Pupuntahan ka namin,” or “Ipapahiya ka namin sa trabaho.”
Texting your family, friends, co-workers, or employer about your debt.
Sending your photo, ID, or loan details to other people.
Calling you a scammer, thief, estafador, or criminal without a valid court finding.
Threatening violence, arrest, barangay action, deportation, or “legal raid.”
Using fake titles such as “attorney,” “sheriff,” “police,” “NBI,” or “court officer.”
Collecting through insults, profanity, sexual comments, or degrading language.
Demanding payment through a personal GCash, Maya, bank account, or number not clearly connected to the registered lender.
Contacting you before 6:00 a.m. or after 10:00 p.m. in a manner prohibited by SEC rules.
Using information from your phone contacts, gallery, location, or social media to pressure you.

Not every collection message is illegal. A lender may remind you of a due date, ask for payment, send a statement of account, or inform you that it may pursue lawful remedies. The problem begins when the collection method becomes abusive, deceptive, threatening, privacy-invasive, or directed at people who are not legally responsible for your loan.

Your Basic Rights as a Borrower in the Philippines

You cannot be jailed simply for unpaid debt

The 1987 Philippine Constitution states that no person shall be imprisoned for debt. This means a borrower cannot be jailed merely because they failed to pay a civil loan obligation. (Supreme Court E-Library)

However, this does not mean loans can be ignored. A lender may still file a proper civil collection case, report legitimate credit information through lawful channels, or take other legal steps allowed by law. Criminal liability may arise only if there is a separate crime, such as fraud, falsification, identity theft, threats, or bouncing checks, depending on the facts.

A lender may collect, but only through lawful and fair means

The Securities and Exchange Commission regulates lending companies under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, and financing companies under related laws. SEC Memorandum Circular No. 18, Series of 2019 specifically prohibits unfair debt collection practices by financing companies, lending companies, and their third-party service providers. (Lawphil)

Under SEC MC No. 18, prohibited practices include:

Use or threat of violence or other criminal means.
Threats to take action that cannot legally be taken.
Obscenities, insults, or profane language that amount to abuse.
Disclosure or publication of borrowers’ names and personal information for allegedly refusing to pay.
Communicating false loan information to others.
False representation or deceptive means to collect.
Contacting the borrower at unreasonable or inconvenient times, subject to the circular’s specific rules.
Contacting people in the borrower’s contact list other than those named as guarantors or co-makers, even if the borrower supposedly gave consent.

This last rule is very important. If the lending app texts your mother, spouse, employer, co-worker, or random phone contacts even though they are not your guarantor or co-maker, that can be an unfair debt collection practice.

Your personal data is protected

The Data Privacy Act of 2012, or Republic Act No. 10173, protects personal information handled by private companies and government agencies. Borrowers are “data subjects,” which means they have rights over personal data collected, stored, used, shared, or disclosed by a lending app. The National Privacy Commission explains that data subjects have rights such as the right to be informed, access, correction, objection, erasure or blocking, and damages for misuse of personal data. (National Privacy Commission)

For online lending, the NPC issued rules on loan-related transactions. NPC Circular No. 20-01 and NPC Circular No. 2022-02 address the use of personal data in loan applications, character references, loan collection, and closure of accounts. The NPC has repeatedly acted against online lending apps that accessed contact lists or other phone data in ways that violated the principles of transparency, legitimate purpose, and proportionality. (National Privacy Commission)

In plain English: a lending app should not collect more data than necessary, hide what it will do with your data, or use your data for harassment.

What Laws May Apply to SMS Harassment?

Problem	Possible legal basis	Where it usually goes
Threats, insults, public shaming, contacting non-guarantor contacts	SEC MC No. 18, Series of 2019	SEC
Accessing contact lists, photos, IDs, phone data, or sharing debt information	RA 10173, Data Privacy Act; NPC Circulars on loan-related transactions	NPC
Threats of harm, intimidation, coercion, repeated abusive conduct	Revised Penal Code Articles 282, 285, 286, 287	Police, prosecutor
Defamatory posts or messages online	Revised Penal Code libel provisions; RA 10175 Cybercrime Prevention Act	Police, NBI, prosecutor
Identity theft, fake accounts, unauthorized use of your photo or details	RA 10175 Cybercrime Prevention Act; Data Privacy Act	PNP-ACG, NBI Cybercrime, DOJ-OOC, NPC
Bank, e-wallet, or BSP-supervised financial institution issue	RA 11765; BSP consumer assistance channels	BSP
SEC-regulated lending or financing company issue	RA 11765; SEC rules	SEC

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, also protects financial consumers and gives financial regulators such as the SEC, BSP, Insurance Commission, and CDA authority over financial service providers within their jurisdiction. It covers financial products and services, including credit, and recognizes consumer rights such as fair treatment, disclosure, data privacy, and timely complaint handling. (Supreme Court E-Library)

Step-by-Step Guide: How to Stop SMS Harassment from Online Lending Apps

1. Preserve evidence before blocking, deleting, or uninstalling

Do not rely on memory. Agencies will need proof.

Save:

Screenshots of all SMS messages, with date, time, sender number, and full content visible.
Call logs showing repeated calls.
Messages sent to your contacts, employer, relatives, or friends.
Screenshots from the people who received the messages.
The app name, logo, developer name, website, Facebook page, or Play Store/App Store page.
Loan agreement, disclosure statement, amortization schedule, interest, penalties, and charges.
Proof of payments.
Screenshots of app permissions, privacy policy, and terms before uninstalling.
Any threats using fake police, court, barangay, lawyer, or NBI language.
Wallet or bank account details where the collector demanded payment.

For stronger evidence, export or back up SMS threads, save screen recordings, and keep the original phone if possible. Screenshots are useful, but investigators may later ask to inspect the original device or message source.

2. Identify the real company behind the app

Many apps use brand names different from the company’s legal name. Look for:

Company name in the loan agreement.
SEC registration number.
Certificate of Authority number, if shown.
Privacy policy company name.
Collection agency name.
Email address, website, office address, and customer service number.
Payment account name.

If the app hides the legal company name, say that in your complaint. Concealment or confusing identity is itself relevant because SEC MC No. 18 requires collection personnel to disclose their full name or true identity to the borrower.

3. Send one firm written notice to the lender

A short written notice can help show that you objected and gave the company a chance to stop. Send it through the app’s customer support email, in-app support, official Facebook page, or registered contact details.

You can use this wording:

I am requesting that all collection communications be made only through lawful, respectful, and privacy-compliant means. Do not contact my relatives, employer, co-workers, or phone contacts unless they are legally named as guarantors or co-makers. Do not disclose my personal information, loan details, photo, ID, or alleged debt to third parties. Please identify the registered company name, SEC registration details, Certificate of Authority, name of the collector, statement of account, and lawful basis for processing my personal data. I reserve my rights to file complaints with the SEC, NPC, and law enforcement for unfair debt collection, data privacy violations, threats, and harassment.

Keep proof that you sent it.

Do not argue emotionally. Do not send insults back. Do not admit facts that are not true. Do not send new IDs, passwords, OTPs, selfies, or contact lists.

4. Revoke unnecessary app permissions

After saving evidence, review your phone permissions.

On Android or iPhone, check whether the app has access to:

Contacts
Photos or gallery
Camera
Microphone
Location
Files
SMS
Call logs
Social media login

Revoke anything unnecessary. If the app will not function without excessive permissions, take screenshots showing that. The NPC has treated excessive and unnecessary app permissions in online lending as a serious privacy issue, especially where the permissions allow access to contact lists, location, storage, or other data not proportionate to loan processing. (National Privacy Commission)

5. File a complaint with the SEC for unfair debt collection

File with the Securities and Exchange Commission when the issue involves:

Harassing or abusive collection.
Contacting your contacts, employer, or relatives.
Misleading threats of arrest, court action, or criminal cases.
Hidden charges, excessive penalties, or unclear loan terms.
Unregistered or suspicious lending activity.
Collection agents refusing to identify themselves.
Apps operating as lending or financing companies without proper authority.

The SEC has an iMessage ticketing system for public inquiries, complaints, incidents, and requests, which provides ticket tracking and centralized handling. (Securities and Exchange Commission)

In your SEC complaint, include:

Your full name, contact details, and address.
App name and company name, if known.
Loan amount, date borrowed, due date, payments made, and current dispute.
Exact harassment incidents, arranged by date.
Screenshots and files as attachments.
Names and numbers of collectors, if visible.
Names of third parties contacted, with their screenshots.
Specific request: investigation, order to stop harassment, sanctions, and verification of authority to operate.

SEC MC No. 18 allows administrative penalties, including fines. For repeated or serious violations, the SEC may impose heavier sanctions, including suspension or revocation of authority to operate, depending on the circumstances.

6. File a complaint with the NPC for data privacy violations

File with the National Privacy Commission when the lending app:

Accessed or used your contact list.
Texted or called your contacts.
Sent your photo, ID, or loan details to others.
Posted or threatened to post your personal information.
Used your data for purposes not properly disclosed.
Refused to delete or correct unlawfully obtained data.
Continued processing your personal data after you objected.
Required excessive phone permissions.

The NPC says formal complaints must follow a specific format. Its complaint procedure includes downloading the form, printing and filling it out, having it notarized, and submitting it in person, by courier, or by scanning and emailing the notarized complaint to the NPC. Fees may apply under the NPC fee schedule. (National Privacy Commission)

A strong NPC complaint should include:

A notarized complaint-affidavit.
Copy of government ID or passport.
Screenshots of the harassment.
Screenshots from contacted third parties.
Privacy policy and app permission screenshots.
Loan agreement or account screenshots.
Written request you sent to the lender, if any.
Timeline of events.
Clear explanation of what data was misused and how.

For OFWs or foreigners abroad, notarization can be the bottleneck. If a Philippine agency requires a notarized affidavit executed abroad, check whether the document should be acknowledged before a Philippine Embassy or Consulate, or notarized locally and apostilled if the country is part of the Apostille Convention. Keep both scanned and original copies because agencies may accept an emailed scan for initial filing but later require originals.

7. Report threats or cyber harassment to law enforcement

If the SMS messages contain threats of harm, blackmail, identity theft, fake accounts, sexualized harassment, defamatory posts, or impersonation of authorities, consider a criminal complaint.

Possible offices include:

PNP Anti-Cybercrime Group.
NBI Cybercrime Division.
DOJ Office of Cybercrime.
Local police station for immediate threats or blotter documentation.
City or provincial prosecutor’s office for formal criminal complaints.

The DOJ Office of Cybercrime has publicly encouraged reporting of unfair debt collection practices and cyber harassment involving online lending companies. (Department of Justice)

Relevant criminal provisions may include:

Article 282, Revised Penal Code — grave threats, when a person threatens another with a wrong amounting to a crime.
Article 285 — other light threats.
Article 286 — grave coercion, when someone uses violence, threats, or intimidation to compel another to do something against their will.
Article 287 — unjust vexation or other coercions, often raised for repeated acts that unjustly annoy, distress, or disturb a person.
RA 10175, Cybercrime Prevention Act of 2012 — for covered acts committed through information and communications technology, including online libel and computer-related offenses. (Lawphil)

The Supreme Court in Disini v. Secretary of Justice, G.R. No. 203335 upheld cyberlibel as online defamation under the Cybercrime Prevention Act, explaining that online defamation is treated as a similar means of committing libel under the Revised Penal Code. (Lawphil)

8. Secure your accounts and warn your contacts calmly

If your contacts are receiving messages, send a short neutral warning:

Please ignore any messages from people claiming I owe money or asking for payment. They are not authorized to contact you about my private account. Please send me screenshots, including the number, date, and full message, so I can include them in official complaints.

Do not ask contacts to fight with collectors. The goal is to gather clean evidence, not create more conflict.

Also secure your accounts:

Change passwords for email and social media.
Turn on two-factor authentication.
Do not share OTPs.
Report fake profiles using your name or photo.
Block collector numbers only after saving evidence.
Keep a list of all numbers used.

9. Pay only through verified official channels if you decide to pay

Harassment does not erase a legitimate debt, but it also does not make abusive collection lawful.

If you decide to pay:

Pay only to the official company account, not a collector’s personal wallet.
Ask for a statement of account.
Ask for written confirmation that payment fully settles the account, if applicable.
Keep receipts and transaction references.
Avoid “discount” offers that are not in writing.
Do not give new personal data just to get a settlement.

If the app is unregistered, uses hidden company names, or demands payment to suspicious personal accounts, include that in your SEC complaint.

What Government Office Should You Choose?

Office	Best for	Practical notes
SEC	Unfair debt collection by lending or financing companies; abusive collectors; unregistered lending apps	File with app/company details, screenshots, loan documents, and third-party messages
NPC	Contact list harvesting, disclosure of debt, use of photos/IDs, privacy policy violations, excessive app permissions	Formal complaint usually requires a notarized complaint-affidavit
PNP-ACG / NBI Cybercrime	Threats, cyber harassment, fake accounts, identity theft, blackmail, online defamation	Bring phone, screenshots, links, numbers, and original messages
DOJ Office of Cybercrime	Cybercrime reports and coordination	Useful for serious ICT-related harassment and online lending abuse
BSP	Banks, e-wallets, BSP-supervised financial institutions	BSP directs consumers to first raise the concern with the institution’s consumer assistance mechanism, then escalate through BSP channels if unresolved. (Bureau of Small and Medium Enterprises)
Local police / barangay blotter	Immediate safety threats, local incidents, documentation	Barangay is usually not the main regulator for online lending apps, but a blotter may help document threats

Common Mistakes That Weaken Complaints

Deleting messages too early

Many borrowers panic and delete everything. Save first. Take screenshots, back up the phone, and ask contacted friends to send screenshots.

Filing only a vague complaint

“Hinaharass po ako” is not enough. Agencies need dates, times, numbers, exact words, screenshots, and the app/company name.

Paying a collector’s personal account

This can create a second problem: you may pay but the lender may not credit it. Always verify the official payment channel.

Assuming consent allows everything

Some lending apps claim you “agreed” to let them access contacts. Under SEC MC No. 18, contacting people in your contact list other than guarantors or co-makers can still be an unfair collection practice even if the borrower supposedly consented.

Ignoring data privacy issues

If the harassment involved your contacts, photo, ID, phonebook, or employer, the complaint is not only about debt collection. It may also be a data privacy issue for the NPC.

Posting accusations without proof

It is understandable to be angry, but public accusations can create separate defamation risks. Use official complaints and attach evidence.

Changing numbers without preserving evidence

Changing SIMs may give temporary peace, but if you lose the old messages or phone logs, your complaint becomes weaker. Back up first.

Practical Timeline: What Usually Happens After Filing

Stage	What to expect
Evidence gathering	Same day to several days, depending on how many contacts were messaged
SEC ticket or complaint filing	Usually starts with online submission and ticket/reference tracking
NPC formal complaint	Takes longer if notarization, proper form, attachments, or original copies are needed
Law enforcement report	Faster for urgent threats, slower if the sender must be traced through numbers, accounts, or platforms
Agency evaluation	May require additional documents, clearer screenshots, or proof linking the app to the company
Possible outcomes	Warning, order to answer, investigation, administrative penalties, takedown-related action, referral for criminal investigation, or formal case filing

A common bottleneck is identifying the real operator behind the app. Another is proving that the collector who sent the SMS was acting for the lending company. That is why screenshots of the app name, account number, collector messages, payment instructions, and loan documents should be kept together.

Frequently Asked Questions

Can an online lending app have me arrested for not paying?

Not simply for unpaid debt. The Constitution prohibits imprisonment for debt. A lender must use lawful civil remedies. Arrest threats are often misleading unless there is a separate criminal case based on facts that amount to a crime.

Can a lending app text my contacts?

Not for debt shaming or pressure. Under SEC MC No. 18, contacting people in your contact list other than those named as guarantors or co-makers is an unfair debt collection practice. Using contact lists may also raise Data Privacy Act issues.

Should I file with the SEC or NPC?

File with the SEC for unfair collection practices, abusive collectors, hidden charges, or questionable lending authority. File with the NPC for misuse of personal data, contact list access, debt disclosure, photos, IDs, or privacy violations. Many online lending harassment cases should be filed with both.

What if the messages come from different random numbers?

Save each number and message. Include all of them in your complaint. Repeated use of different numbers can show a pattern of harassment. If the messages identify the same app, loan account, payment channel, or collector script, point that out.

Can I complain even if I really owe money?

Yes. The issue is not only whether the loan exists. The issue is whether the lender used unlawful, abusive, deceptive, or privacy-violating collection methods.

Can I demand deletion of my data?

You can object to unlawful processing and request blocking, removal, or deletion of personal data under the Data Privacy Act, especially if the data was unlawfully obtained, used for unauthorized purposes, or is no longer necessary. The lender may retain some records required by law, regulation, accounting, or legitimate claims, but it cannot use that as an excuse for harassment.

What if I am an OFW or foreigner outside the Philippines?

You can still document the harassment and file with Philippine agencies if the lending app, borrower account, victim contacts, or company is connected to the Philippines. The practical issue is notarization. If a notarized complaint-affidavit is required, prepare for consular acknowledgment or apostille requirements, depending on where the document is executed and what the receiving agency accepts.

Can I sue for damages?

Possible remedies may include administrative complaints, criminal complaints, and civil claims for damages, depending on the facts. The Data Privacy Act recognizes damages for unauthorized or unlawful use of personal data, and the Civil Code may also support damages where abusive acts violate rights, privacy, honor, or cause injury. The stronger your evidence, the more realistic the remedy.

Is uninstalling the lending app enough to stop harassment?

Not always. Uninstalling may stop further app access, but it does not erase data already collected. Save evidence first, revoke permissions, uninstall if needed, and file complaints if the lender already misused your data.

What if the app threatens to post me on Facebook?

Take screenshots immediately. A threat to publish your name, face, ID, or debt information may support complaints for unfair debt collection, data privacy violations, and possibly criminal liability if the facts show threats, coercion, or cyber-related offenses.

Key Takeaways

Unpaid debt does not justify harassment. Lenders may collect only through lawful and fair means.
You cannot be jailed simply for failing to pay a loan. Civil debt is not a basis for imprisonment.
Texting your contacts is a major red flag. It may violate SEC rules and the Data Privacy Act.
Save evidence before blocking or deleting anything. Screenshots, call logs, app details, and third-party messages matter.
File with the right office. SEC for unfair collection, NPC for data misuse, PNP/NBI/DOJ for threats or cybercrime, BSP for BSP-supervised institutions.
Do not pay personal accounts of collectors. Use only verified official payment channels and keep receipts.
A strong complaint is specific. Include dates, numbers, screenshots, company details, loan documents, and a clear timeline.