Quick answer

Report online lending app harassment to the lender’s consumer-assistance unit and, for most lending or financing companies, to the Securities and Exchange Commission (SEC) through the SEC iMessage portal. Report misuse or disclosure of personal data separately to the National Privacy Commission (NPC). If the conduct includes threats, fraud, impersonation, extortion, stalking, or other possible crimes, report it promptly to law enforcement.

A lender may lawfully demand payment, send accurate reminders, negotiate, and use legal remedies. It may not use threats, deception, public shaming, abusive language, or unlawful access to your contacts, photos, or other personal data. Reporting harassment does not automatically erase a valid debt, but owing money does not give anyone permission to abuse you.

What conduct may be unlawful?

For SEC-regulated financing and lending companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by the company and its third-party collectors. These include:

Threatening violence or using criminal means to harm a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name or personal information to shame the borrower, except where disclosure is specifically allowed by law.
Giving other people false loan information or failing to disclose that a debt is disputed.
Using false representations or deceptive methods to collect or obtain information.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed that those are the only convenient times. Any consent must be provable through written, electronic, or recorded means.
Contacting people found in the borrower’s phone contacts merely to pressure or shame the borrower.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, also prohibits abusive collection or debt-recovery practices. A financial service provider is responsible for the acts of its employees and agents and may be solidarily liable with an accredited third-party collector. The lender therefore cannot avoid responsibility simply by saying that an outside collection agency sent the messages.

Contact lists, references, and guarantors

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, an online lending app must not engage in unnecessary or excessive processing of personal data.

The current rules make important distinctions:

An app may obtain only permissions that are suitable, necessary, and not excessive for a legitimate purpose.
Access to a camera or photo gallery may be used at the stage where it is genuinely needed for identity or payment verification. A borrower’s photo must never be used for harassment or embarrassment.
Contact-list access must not be unbridled. It may be used only within the narrow limits allowed by the NPC rules, such as enabling the borrower to select a reference or guarantor or deriving proportionate metadata for a legitimate purpose.
A character reference may be contacted to verify the borrower’s identity or information. A reference cannot be treated automatically as a guarantor or chased for payment.
A guarantor must have expressly agreed to become one. For debt collection, the lender may contact the duly consenting guarantor—not random relatives, friends, co-workers, or other people taken from the phone’s contact list.
Personal data may be retained only as long as necessary for the original purpose, a legal claim, or another lawful retention requirement.

The DICT, NPC, and SEC reiterated these rules in their 18 March 2026 Joint Advisory on Online Lending Platforms, which applies whether an online lending platform is recorded with the SEC or not.

What to do immediately

1. Protect yourself first

If there is a credible threat of physical harm, someone is coming to your home or workplace, or a crime is in progress, call the nationwide emergency hotline at 911 or go to the nearest police station.

If the danger is not immediate:

Tell trusted household members or workplace security about any specific threat.
Do not meet an unidentified collector alone.
Do not click links or install another app sent by the collector.
Do not provide an OTP, PIN, password, card details, or additional identification unless you have independently verified a lawful need and the recipient.
Change compromised passwords and enable multi-factor authentication.
Review the app’s permissions and revoke access to contacts, photos, camera, microphone, location, SMS, or call logs that is no longer necessary.

2. Preserve evidence before blocking, deleting, or uninstalling

Save the evidence in at least two secure locations. Keep:

Screenshots showing the entire message, sender’s number or account, date, and time.
Screen recordings that show the conversation from the account profile through the messages.
Original emails, text messages, voicemails, call logs, and social-media posts.
URLs and screenshots of posts disclosing your identity, photo, debt, or contact information.
The app’s exact name, developer, app-store link, website, package identifier, and version.
The corporate lender’s legal name, SEC registration number, Certificate of Authority number, business address, and customer-assistance details.
The loan agreement, promissory note, disclosure statement, repayment schedule, account history, and receipts.
The privacy notice, consent screens, and permissions requested by the app.
Names or claimed names of collectors and the collection agency they represent.
Statements or screenshots from relatives, co-workers, or other recipients who were contacted.
Proof of your written complaint to the lender and its response, if any.

Ask affected contacts to preserve the original messages on their own devices. A screenshot forwarded to you is useful, but their original copy and a signed account of what happened may be stronger evidence.

Avoid secretly recording a live telephone conversation without legal advice. The Anti-Wiretapping Act can restrict recording private communications without the required consent.

3. Identify the real lender

The app name may differ from the corporate lender named in the contract. Check the loan agreement, disclosure statement, privacy notice, app-store page, website, and payment instructions.

A legitimate lending company must have an SEC Certificate of Authority to operate, not merely a certificate of incorporation. An app’s claim that it is “SEC registered” does not by itself prove that it is authorized to lend or that the particular online platform has been properly disclosed.

If you cannot identify the operator, include every available identifier in your reports: app name, screenshots, payment-account holder, phone numbers, email addresses, website, app-store URL, and developer name. The 2026 joint advisory expressly directs the public to report abusive conduct even when the platform is unrecorded.

Send a written complaint and preservation demand

Before escalating, send a concise complaint to the lender’s official consumer-assistance unit and data protection officer, if listed. Republic Act No. 11765 requires financial service providers to maintain a free consumer-assistance mechanism.

State:

Your name and account or loan reference, with sensitive digits masked where possible.
The collector’s number, name, or account.
A chronological description of each incident.
The people contacted and the information disclosed.
The app permissions or personal data allegedly misused.
Whether you dispute the debt, amount, charges, or only the collection conduct.
The action you want: stop third-party contact, preserve records, investigate the collector, remove unlawful posts, correct inaccurate data, restrict processing, or communicate only through an identified written channel.
A request for the complaint reference number and written findings.

Also instruct the lender to preserve relevant call logs, messages, access logs, collector assignments, contact-list processing records, account notes, recordings lawfully made by the company, and communications with third-party collectors.

Do not admit an amount you genuinely dispute. At the same time, do not falsely deny a valid loan. Keep the payment dispute and the harassment complaint clearly separated.

How to report to the SEC

Use the SEC for unfair collection by a lending company, financing company, online lending platform, or its collection agent.

Open the SEC iMessage portal.
Create or sign in to your account and open a new ticket.
Direct the complaint to the Financing and Lending Companies Department (FINLEND).
Identify both the app and the corporate lender.
Describe the events chronologically and specify which people were contacted.
Attach your evidence, loan documents, valid identification, and proof that you complained to the lender.
Save the SEC ticket or reference number and every later submission.

The March 2026 joint advisory also lists the SEC hotline as 1-4732 (1-4SEC).

The SEC can investigate regulatory violations and impose appropriate administrative measures. A complaint does not authorize the SEC to rewrite your contract, declare every charge void, or cancel a valid loan automatically. Contract validity, damages, and repayment liability may require a separate proceeding and depend on the documents and facts.

How to file a privacy complaint with the NPC

Use the NPC when the app or collector accessed, used, retained, or disclosed personal data beyond a lawful and proportionate purpose—for example, harvesting contacts, messaging co-workers, posting a borrower’s photo, or using reference information for debt collection.

First notify the respondent

The NPC generally requires exhaustion of remedies. Notify the lender or responsible entity in writing and give it an opportunity to act. The NPC’s published mechanics state that proof should be attached when the respondent failed to take timely or appropriate action or gave no response within 15 calendar days from receipt.

If you could not safely contact the respondent, the current form allows you to state why. Explain the circumstances rather than leaving the section blank. Ongoing serious harm may also justify asking the NPC about urgent interim relief.

Prepare and file the current form

Use the NPC’s Complaint-Affidavit effective 1 July 2025, not an old form circulating online. Complete it accurately, have it properly notarized, and attach:

A valid government-issued ID.
Proof of the personal data processed or disclosed.
Your chronological evidence.
Witness affidavits, where available.
Your written notice to the respondent and proof of receipt.
The response, or proof that 15 calendar days passed without one.
The specific relief you are requesting.

The NPC accepts complaints through the methods stated on its official complaint page. Its current website directs emailed complaints to complaints@privacy.gov.ph and lists its office at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Barangay Paligsahan, Quezon City. Follow the NPC’s current PDF and digital-signature requirements when filing electronically.

The current basic NPC complaint filing fee is ₱500, plus a legal research fee of 1% of the filing fee but not less than ₱10. Additional fees or bonds may apply if you claim damages or seek a temporary ban. Qualified indigent litigants may apply for exemption subject to the documentary requirements in the NPC Schedule of Fees and Charges.

If unlawful processing is continuing and may cause serious harm, ask about an application for a temporary ban on processing personal data. This is separate relief with its own form, evidence, hearing requirements, and possible bond; it is not granted automatically.

When to report to the BSP instead

If the app is operated by a bank, digital bank, non-bank electronic-money issuer, or another Bangko Sentral-supervised institution, complain first through that institution’s financial consumer assistance mechanism. If unresolved, elevate the matter through the BSP Consumer Assistance Mechanism:

Use the BSP Online Buddy or BOB on the BSP website.
Alternatively, submit the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph.
Attach your complaint to the institution, its response, and your supporting evidence.

An app may involve more than one entity—for example, an SEC-regulated lender using a BSP-supervised payment provider. Direct each complaint to the regulator with jurisdiction over the entity and conduct involved.

When to contact cybercrime or law-enforcement authorities

Do not wait for the SEC or NPC process if the messages involve a credible threat, extortion, fake warrants or summonses, account takeover, identity theft, hacking, stalking, or fraud. The 2026 joint government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491
NBI online complaint facility: nbi.gov.ph/online-complaint

Bring the original device if investigators request it, but back up relevant evidence first. Do not edit screenshots or impersonate the collector in an attempt to gather more evidence.

The precise criminal offense, if any, depends on the actual words, conduct, intent, and evidence. Possible regulatory or privacy violations do not automatically establish criminal liability; police, prosecutors, and courts make that determination.

What harassment does—and does not—change about the loan

Harassment does not automatically extinguish principal, lawful interest, or other valid contractual obligations. Continue keeping records of any undisputed payments and ask for an official statement of account. Pay only through a verified company channel and obtain a receipt.

At the same time:

A collector cannot lawfully use humiliation as a substitute for court process.
An ordinary unpaid debt alone does not result in imprisonment. Article III, Section 20 of the 1987 Constitution states that no person shall be imprisoned for debt.
A lender may still file a lawful civil case or pursue other remedies allowed by the contract and law.
Separate conduct—such as fraud or another independently defined offense—may have different consequences. Do not ignore genuine court papers.

A real summons comes from a court through authorized service, identifies an actual case and court, and can be verified directly with that court. A collector’s text saying “may kaso ka na” is not itself a summons or arrest warrant.

Common mistakes that can weaken a complaint

Deleting the app or conversation before preserving identifiers and evidence.
Cropping screenshots so tightly that the sender, date, or context disappears.
Naming only the app and not the corporate lender.
Sending accusations publicly and exposing your own or another person’s private data.
Filing with the NPC without the current form, evidence, valid ID, notarization, or explanation of prior written notice.
Mixing complaints against several unrelated companies without clearly separating each respondent and incident.
Claiming that every reminder is harassment. Regulators need the exact words, timing, recipients, and conduct.
Paying an unidentified personal account because a collector threatened immediate arrest.
Ignoring authentic court documents because earlier messages were fake.
Assuming that revoking app permissions deletes copies already obtained. Request restriction or deletion in writing, but understand that lawful retention may continue for the loan, regulatory obligations, or legal claims.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if you may qualify, or another appropriate legal-aid provider promptly when:

There is a threat to kill, injure, abduct, or damage property.
Intimate images, altered photos, identity documents, or home addresses are being circulated.
The collector is contacting your employer, customers, school, or a large part of your community.
Money is being demanded to prevent publication of damaging material.
You received a genuine subpoena, summons, complaint, warrant, or court order.
Your identity or account was used to obtain a loan you did not apply for.
You want damages, an injunction, or criminal charges.
Several lenders or collection agents are involved and corporate responsibility is unclear.
A filing deadline may be approaching.

Claims under Republic Act No. 11765 generally prescribe after five years from consummation of the financial transaction or five years from discovery of deceit or material nondisclosure, but in any event after ten years from the violation, subject to the Act’s terms and exceptions. Other civil, criminal, privacy, and administrative remedies may have different periods, so do not assume that this is the deadline for every possible case.

Frequently asked questions

Can a lender call my relatives or employer?

Not merely because their numbers appeared in your contact list. A character reference may be contacted for proper identity or information verification, not made responsible for the debt. For collection, the current NPC rules allow contact with a guarantor who expressly consented to that role. The legality of contacting a genuine co-maker or another actual party to the loan depends on the contract and that person’s independent obligation.

What if I allowed contact access when installing the app?

Consent does not authorize unlimited processing. Permissions and processing must still be necessary, proportionate, transparent, and used for a lawful stated purpose. The current government advisory prohibits excessive contact-list processing and using it to harass or collect from people other than a duly consenting guarantor.

Can I demand that all my data be deleted?

You may exercise your data-subject rights and request deletion, restriction, correction, or objection where applicable. Deletion is not absolute: the lender may retain data needed to administer an existing loan, comply with law, or establish, exercise, or defend legal claims. It must not keep or use data indefinitely without a lawful purpose.

Should I stop paying after reporting harassment?

Not solely because you filed a complaint. Pay any amount you acknowledge only through a verified official channel, preserve receipts, and dispute incorrect amounts in writing. Seek advice if the contract, charges, lender’s authority, or account ownership is contested.

Am I responsible because someone listed me as a reference?

No. A character reference is not automatically a guarantor. A guarantor must expressly consent to be legally bound. Tell the lender in writing that you did not agree to guarantee the loan and request removal of your data as a reference where appropriate.

Can I block the collector?

Yes, after preserving evidence, particularly where contact is abusive or threatening. First provide a safe written channel for legitimate account communications if practical. Blocking one number does not replace a regulatory or police report where serious misconduct occurred.

Can I complain even if the app is unregistered?

Yes. Preserve every identifier and report the conduct. The March 2026 joint advisory covers recorded and unrecorded online lending platforms. Lack of registration may itself be relevant to the SEC’s assessment.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and liability depend on the lender’s regulator, the contract, communications, and available evidence. Sources and official filing information were checked on 27 August 2026.