Quick answer

Yes. Harassment is not a lawful debt-collection method, even when the loan is valid and overdue.

For most online lending apps:

Report abusive collection practices to the Securities and Exchange Commission (SEC).
Report misuse or disclosure of personal data to the National Privacy Commission (NPC).
Report credible threats, extortion, impersonation, hacking, fraud, or other potentially criminal conduct to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.
If anyone is in immediate danger, call Unified 911 or go to the nearest police station.

The same incident may properly be reported to more than one agency because each has a different mandate. Preserve the evidence before blocking numbers, revoking permissions, or uninstalling the app.

A complaint does not automatically cancel the loan, stop lawful interest, or erase a valid payment obligation. It challenges the lender’s collection methods or handling of personal data.

What conduct may be unlawful?

Lenders and their collection agencies may send lawful reminders, demand payment, negotiate, and pursue remedies allowed by the loan agreement and law. They must act in good faith and use reasonable, legally permissible means.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices include:

Using or threatening violence or other criminal means against a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing a borrower’s name or personal information to shame the borrower;
Communicating loan information known—or reasonably expected—to be false, including failing to say that a debt is disputed when communicating it to another person;
Pretending to be a government officer, lawyer, court representative, or another person;
Using deceptive means to collect a debt or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions for accounts overdue by more than 15 days or the borrower’s recorded consent that those hours are the only reasonable or convenient time; and
Contacting people in the borrower’s contact list who were not properly named as guarantors or co-makers.

The lender remains responsible for collection practices outsourced to an agency or other third-party service provider. The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, also prohibits abusive collection or debt-recovery practices and requires fair treatment, data protection, and an accessible consumer-assistance mechanism.

Privacy rules specifically applicable to lending apps

The Data Privacy Act of 2012 requires personal-data processing to be transparent, lawful, proportionate, and limited to a legitimate purpose.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, and the government’s March 2026 joint advisory on online lending platforms:

An app cannot require unnecessary or excessive permissions.
Access to contacts cannot be unbridled, unconstrained, or disproportionate to a legitimate purpose.
Contact lists cannot be harvested or copied for public shaming or harassment.
For collection, a lender cannot contact ordinary saved contacts. Current privacy guidance permits contact with a guarantor who separately and expressly consented to assume responsibility for the loan.
A character reference is not automatically a guarantor. Character references are for verifying identity or information, not for pressuring them to pay the borrower’s debt.
Camera or gallery access may be used when necessary for identity verification or fraud prevention, but a borrower’s photograph cannot be used to humiliate or threaten them.
Once the purpose for a permission has been completed and no other lawful basis remains, the app should prompt the user to revoke or disable that permission.
Loan data must not be kept indefinitely. Retention may continue when necessary for the loan, legal compliance, or the establishment, exercise, or defense of legal claims, but the data must be securely disposed of afterward.
The lender remains accountable for personal data handled by its collection agency, technology provider, or other processor.

Clicking “Allow” does not necessarily legalize every later use. Consent must be freely given, specific, and informed. Deceptive interfaces, pre-ticked boxes, hidden choices, or consent obtained for one purpose but used for another may be challenged.

Preserve evidence before taking other action

Save both the content and the context of every incident. Useful evidence includes:

Unedited screenshots showing the full message, sender, date, and time;
Screen recordings showing the app name, account, conversation, and surrounding messages;
Original SMS, email, voicemail, chat, or social-media files;
Call logs and recordings lawfully made or received by you;
The collector’s telephone numbers, usernames, profile links, email addresses, and claimed name or position;
Posts, comments, group messages, altered photographs, or public notices containing your information;
The app-store page, developer name, privacy notice, terms, and permission requests;
Screenshots of the permissions actually granted to the app;
The loan agreement, disclosure statement, promissory note, repayment schedule, receipts, and account statement;
Proof identifying the legal lender, app operator, and collection agency;
Copies of your written complaint to the company and its response;
Messages received by relatives, co-workers, employers, references, or other contacts; and
A chronological incident log stating what happened, who was involved, and how it affected you.

Ask affected contacts to preserve the original messages on their own devices. If possible, obtain a signed statement explaining when and how they were contacted and what information was disclosed.

Keep an untouched copy of each file in a second secure location. Do not rely only on cropped screenshots or social-media reposts. If a criminal investigation is likely, avoid factory-resetting, selling, or replacing the device until investigators advise you about preservation.

Identify the correct respondent

The app’s brand name may differ from the corporation that issued the loan. Look for the legal entity in:

The loan agreement and disclosure statement;
The app’s privacy notice and terms;
Payment receipts and bank-transfer instructions;
The app-store developer information;
Collection notices; and
SEC registration or licensing information.

Check the company through Check with SEC. Record the corporation’s exact name, SEC registration details, Certificate of Authority information if available, app name, and collection agency.

An app’s presence in an app store does not prove that its operator is licensed. Report the conduct even if the operator appears unregistered or uses only a trade name. The NPC’s loan-data rules also cover persons acting as lenders whether or not they obtained SEC authority.

Send a written complaint to the lender first

Send the complaint to the lender’s consumer-assistance unit, customer service, compliance officer, and data protection officer, if their addresses are available. Use email or another method that provides proof of delivery.

State:

Your name and loan or account reference, without sending passwords, PINs, OTPs, or unnecessary identity documents;
The dates and exact acts complained of;
The collector’s name, number, or account;
The personal data accessed, used, or disclosed;
The names or categories of third parties contacted;
Whether the debt or amount is disputed;
The action you want, such as stopping third-party contact, correcting false information, identifying the collector, restricting unlawful processing, or communicating only through a specified channel; and
A request for a written response and preservation of relevant call, message, access, disclosure, and collection records.

For a privacy complaint, ask the company to identify the personal-information controller, the source and purpose of the data, the recipients, the lawful basis for processing, and the applicable retention period. You may request correction, blocking, removal, or destruction when the legal requirements are met. Erasure is not absolute if particular records must still be retained for a valid loan, legal obligation, or legal claim.

How to report unfair collection to the SEC

The SEC regulates lending and financing companies, their online lending platforms, and their collection agents.

The government’s current channel is the SEC iMessage portal. Select the service for financing and lending complaints and retain the ticket or reference number. The March 2026 government advisory also lists the SEC hotline as 1-4732 (1-4SEC).

For a formal complaint:

Use the complaint form linked on the SEC lending and financing complaint page.
Complete one complaint form for each respondent company.
Use the company’s legal name, not only the app name.
Attach a valid government-issued ID and all relevant evidence.
Include the loan documents, disclosure statement, receipts, payment schedule, messages, and proof of third-party contact.
Explain which acts violated SEC Memorandum Circular No. 18 or other applicable lending rules.

The SEC’s posted procedure states that the respondent company is ordinarily given 10 days from receipt of the complaint to submit its answer or comment. The SEC may close a resolved matter, request a reply, refer an issue to another agency, or commence administrative proceedings when supported by sufficient grounds.

How to file a privacy complaint with the NPC

1. Give the respondent an opportunity to act

Under the 2021 NPC Rules of Procedure, a formal complaint generally must show that:

You informed the company or other responsible entity of the privacy violation in writing; and
It failed to take timely and appropriate action or did not respond within 15 calendar days after receiving your notice.

The NPC may waive this requirement for proven good cause or a serious violation, including grave and irreparable harm, absence of an adequate remedy, or conduct that is patently illegal. If you cannot safely contact the respondent, explain and document why.

2. Complete the current complaint-affidavit

Use the NPC’s 2026 Complaint-Affidavit/Reklamong Salaysay form. It requires, among other things:

Complainant and respondent details;
The personal data involved;
A chronological narration;
The alleged privacy violations;
Supporting evidence;
Correspondence showing exhaustion of remedies, or an explanation for not contacting the respondent;
The relief requested;
Verification and certification against forum shopping;
Notarization; and
A valid government-issued ID.

A representative generally needs a special power of attorney. An affected contact may file in their own capacity because the contact’s personal data was processed; the borrower cannot automatically represent that person without the required authority.

3. Submit through an authorized channel

The NPC rules permit personal filing, registered mail, courier, and electronic filing when authorized by the Commission. Check the NPC complaint page and current contact page immediately before submission for the accepted address, email route, required number of copies, and applicable fee.

The rules provide exemptions or possible waivers for qualified indigent complainants and other specified parties. Do not omit notarization, evidence, or the certification against forum shopping merely because the complaint is submitted electronically.

4. Consider a temporary-ban application only for serious ongoing processing

If unlawful processing is continuing and ordinary relief may be inadequate, the NPC has a separate application for a temporary ban. It may be attached to the complaint or filed before the NPC decision becomes final.

This is not an automatic emergency stop. The current procedure requires a notarized application, supporting evidence, judicial affidavits, applicable fees, and a bond in an amount fixed by the investigating officer unless an exemption applies. Legal assistance is advisable.

When to involve law enforcement

Contact law enforcement promptly when the conduct includes:

Credible threats of physical harm;
Threats against children, relatives, property, or employment;
Extortion or demands to pay into an unverified personal account;
Impersonation of police officers, judges, prosecutors, or government agencies;
Hacking, account takeover, identity theft, or unauthorized transactions;
Fabricated warrants or court documents;
Publication of intimate material or sexually degrading content;
Stalking or an unsafe visit to your home or workplace; or
A coordinated fraud or scam.

The March 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

The NBI also provides an online complaint page and accepts requests for investigative assistance for computer crimes. An email report or hotline call may begin the referral process, but investigators may still require a personal interview, sworn statement, original evidence, or examination of a device.

For immediate danger, call Unified 911.

What if the lender is a bank or another BSP-supervised institution?

If the credit provider is a bank, digital bank, e-money issuer, or another BSP-supervised financial institution, complain first through the institution’s Financial Consumer Protection Assistance Mechanism.

If unresolved, escalate through the BSP Online Buddy or another channel on the BSP Consumer Assistance page. BSP guidance expressly directs ordinary financing companies, lending companies, online lending platforms, and their collection agencies to the SEC instead.

Privacy violations may still be reported separately to the NPC.

Protect your phone and accounts

After preserving the evidence:

Revoke unnecessary contacts, call-log, SMS, camera, gallery, microphone, location, and storage permissions;
Check whether the app has accessibility, notification-reading, device-administrator, or “display over other apps” access;
Uninstall the app if it is no longer needed and evidence preservation will not be affected;
Change passwords that were reused elsewhere;
Enable multifactor authentication;
Review bank, e-wallet, email, and social-media activity;
Tell affected contacts not to send money, disclose information, or click links;
Report impersonating accounts and unlawful posts to the platform for preservation and removal; and
Keep paying only through a verified official channel and retain receipts.

Never give a collector your OTP, PIN, password, complete card credentials, or remote access to your phone.

Common mistakes that weaken a complaint

Deleting messages before saving the originals;
Naming only the app instead of the lender’s legal entity and collection agency;
Sending one SEC form against several unrelated companies;
Filing an NPC complaint without first giving written notice or explaining why the requirement should be waived;
Assuming a character reference, spouse, relative, or employer is automatically a guarantor;
Posting IDs, loan documents, and screenshots publicly while asking for help;
Editing screenshots so heavily that the sender, date, or context cannot be verified;
Paying into a personal account without confirming that it belongs to the lender;
Assuming that harassment cancels the debt;
Ignoring a genuine summons because earlier collection messages were fake; or
Filing only with an app store or social-media platform and never reporting to the proper government agency.

When legal help is urgent

Consult a lawyer or qualified legal-aid provider promptly if:

You receive an actual summons, subpoena, prosecutor’s notice, or court order;
The lender claims fraud, estafa, or a bouncing-check offense;
Your identity or financial accounts have been compromised;
Private, sexual, medical, or children’s information has been published;
You need damages, an injunction, or a temporary ban;
Several victims or companies are involved;
The respondent is unidentified, foreign, or appears to be using shell entities; or
Threats are escalating despite reports.

The Constitution prohibits imprisonment for debt alone. However, a separate offense supported by distinct facts is different, and real legal documents must never be ignored. See Article III, Section 20 of the 1987 Constitution.

Claims under Republic Act No. 11765 generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or material nondisclosure, and in any event no later than 10 years after the violation. Other administrative, civil, and criminal remedies may have different periods. File promptly rather than waiting for a deadline.

Frequently asked questions

Can the lender contact everyone in my phone?

No. Current government guidance prohibits uncontrolled processing of a contact list and contacting ordinary contacts for debt collection. A person who separately and expressly consented to be a guarantor may be contacted. A genuine co-maker’s liability depends on the signed documents; a saved contact or character reference is not automatically liable.

I allowed access when I installed the app. Can I still complain?

Yes. Consent must be specific, informed, and freely given. Permission to select a reference or verify identity does not automatically authorize harvesting the entire contact list, public shaming, or unrelated disclosure. Preserve the permission screens and privacy notice, then revoke unnecessary access.

Does reporting the lender mean I no longer need to pay?

No. A complaint addresses unlawful collection or data processing. Continue to deal with any valid obligation through verified channels, while separately disputing incorrect balances, unauthorized loans, or invalid contract terms.

Can a person contacted by the lender file a complaint?

Yes, if that person’s own data was accessed, used, or disclosed. The affected person should preserve the message and may file their own NPC complaint. They may also provide evidence supporting the borrower’s SEC complaint.

Can I report an unregistered or foreign-looking app?

Yes. Provide every available identifier, including the app name, developer, website, payment account, telephone numbers, loan documents, and privacy notice. SEC, NPC, and law-enforcement jurisdiction will depend on the facts, but lack of a visible registration is not a reason to remain silent.

Can I immediately block the collector or uninstall the app?

Usually, but preserve the evidence first. If threats, fraud, or hacking may require forensic examination, consult investigators before deleting data or resetting the device.

Will an SEC or NPC complaint immediately stop the messages?

Not necessarily. Send a written cease-and-correct demand, secure the device, and report any immediate threat to law enforcement. In serious ongoing privacy cases, ask about the NPC temporary-ban procedure, recognizing that it has formal evidence, affidavit, fee, and bond requirements.

Can a collector have me arrested simply for failing to pay?

A person cannot be imprisoned for debt alone. Be cautious of fabricated warrants and threats of automatic arrest. Separate allegations such as fraud or violations involving checks require their own facts and legal process. Verify any official-looking document directly with the named court or agency.

Official references

This article provides general legal information, not advice for a particular case. Outcomes depend on the loan documents, evidence, parties, and applicable procedures. Official sources and filing channels were checked as of 11 August 2026.