Quick answer

Online lending apps may lawfully demand payment of a genuine debt, but they may not threaten, shame, deceive, publicly expose, or misuse personal data to force payment. Accessing a borrower’s contact list, copying contacts for collection, messaging unrelated contacts, posting the borrower’s photo or debt on social media, and sending degrading or threatening messages may violate Securities and Exchange Commission (SEC) collection rules, the Data Privacy Act, and—in serious cases—criminal law.

Report the conduct according to the violation:

SEC: unfair collection by a lending or financing company, an unauthorized lender, or its collection agent.
National Privacy Commission (NPC): unauthorized access, use, disclosure, retention, or publication of personal data.
Philippine National Police Anti-Cybercrime Group (PNP-ACG) or National Bureau of Investigation Cybercrime Division: threats, extortion, impersonation, defamatory online publication, account intrusion, or other suspected cybercrime.
Bangko Sentral ng Pilipinas (BSP): complaints against BSP-supervised banks, electronic-money issuers, and other supervised financial institutions, after first using the institution’s consumer-assistance channel.

These remedies may be pursued separately because the same conduct can violate more than one law. Filing a complaint, however, does not automatically cancel a valid loan or excuse payment of the lawful balance.

Collection is allowed; harassment is not

A lender may ordinarily:

Remind the borrower that payment is due.
State the amount claimed and request payment.
Communicate through legitimate, proportionate channels.
Endorse the account to an identified, authorized collection agency.
Pursue lawful civil remedies for an unpaid debt.

A lender or collector crosses the line when collection involves conduct such as:

Threats of violence, arrest, imprisonment, or harm without a lawful basis.
Insults, obscenities, degrading language, or repeated communications intended to intimidate.
Pretending to be a court, police officer, prosecutor, lawyer, government agency, or another person.
Falsely claiming that a criminal case, warrant, subpoena, or court order already exists.
Publishing or circulating the borrower’s name, photograph, debt, identification document, or fabricated “wanted” notice.
Contacting an employer, coworkers, relatives, friends, or unrelated phone contacts to shame the borrower or reveal the debt.
Using altered photographs, funeral images, sexualized images, or other humiliating material.
Collecting at unreasonable or inconvenient times or through an excessive volume of calls and messages.
Continuing abusive conduct through different numbers after the borrower has demanded that it stop.
Misrepresenting the amount due, the lender’s identity, or the legal consequences of nonpayment.

The SEC’s Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by financing and lending companies. A company remains responsible for collection conducted through its employees, representatives, and outsourced collectors.

Special protection for phone contacts and personal data

The NPC’s Circular No. 2020-01 on loan-related transactions applies to entities processing personal data for loans, including persons acting as lenders even without the required SEC authority.

Under the circular:

An online lending app must not demand unnecessary or excessive phone permissions.
Permissions must be adequate, relevant, necessary, and proportionate to legitimate purposes such as identity verification, creditworthiness assessment, and fraud prevention.
Access to a borrower’s contact list or email list, harvesting social-media contacts, and copying or saving those contacts for debt collection or harassment are prohibited.
An app should use a separate interface through which the borrower voluntarily supplies chosen character references or co-makers.
A photograph obtained for identity verification must not be used to embarrass or harass the borrower.
Personal data must not be kept indefinitely merely for an undefined possible future use.
A lender remains accountable for personal data handled by its collection agency or other service provider.

Consent to ordinary loan processing is not blanket permission to shame the borrower, expose the debt to strangers, scrape every phone contact, or publish personal information. Even when a person was properly named as a character reference, that does not authorize abusive messages or unrestricted disclosure of the borrower’s financial affairs.

The governing statute is the Data Privacy Act of 2012, which requires lawful, fair, and proportionate processing and gives data subjects rights that include information, access, correction, objection in appropriate cases, blocking or erasure under legally applicable conditions, and damages.

What to do immediately

1. Preserve the evidence before blocking or uninstalling anything

Take screenshots or screen recordings showing:

The complete message, post, email, or call log.
The sender’s number, account name, profile, and URL.
The date and time.
Threats, insults, false legal claims, or demands.
Posts or messages sent to relatives, coworkers, employers, or other contacts.
The app’s permissions and privacy notice.
The app’s name, developer, download page, and package details.
Loan disclosures, repayment schedule, receipts, and payment history.
The amount borrowed, amount actually received, fees deducted, payments made, and amount now demanded.

Ask contacted persons to preserve their own copies and, when appropriate, provide a written statement identifying what they received and when. Do not rely only on forwarded screenshots if the original recipient can preserve the original message.

Keep evidence in its original form when possible. Export emails, save URLs, retain original image files, and back everything up. Do not crop away dates, numbers, usernames, or surrounding context.

2. Identify the legal company behind the app

The app’s brand name may differ from the corporation that granted the loan. Check:

The loan agreement and disclosure statement.
The app’s privacy notice and terms.
Payment instructions and recipient account names.
Emails, text messages, official receipts, and collection notices.
The developer information on the app store.

Use the SEC’s official lists and advisories for lending and financing companies. Record whether the company has authority to operate and whether the particular online lending platform was reported to the SEC. An app’s presence in an app store does not by itself prove lawful authority to lend.

3. Secure the phone and online accounts

After preserving evidence:

Revoke the app’s access to contacts, storage, camera, microphone, location, and other unnecessary permissions.
Change passwords for email, social media, mobile banking, and e-wallet accounts if compromise is suspected.
Enable multifactor authentication.
Review logged-in devices and terminate unfamiliar sessions.
Warn contacts not to click payment links or reveal codes and personal information.
Report impersonating or abusive accounts to the relevant platform.
Uninstall the app if it is no longer needed, but first preserve the agreement, statements, receipts, and other evidence stored inside it.

If the phone behaves abnormally or an app was installed outside an official store, obtain technical assistance and consider backing up essential evidence before resetting the device.

4. Send a written demand to the company

Send the lender and its data-protection officer, if identified, a written complaint stating:

Your name and loan-account reference.
The numbers, accounts, and collectors involved.
The specific conduct complained of.
The personal data accessed, copied, disclosed, or published.
The persons contacted and the harm caused.
Your request that harassment and unauthorized processing stop.
Your request to preserve collection logs, instructions, call recordings, account assignments, and access records.
Your request for the collector’s identity and authority.
Your requested privacy remedy, such as correction, blocking, deletion, or cessation of disclosure, subject to legitimate retention duties.
A reasonable request for a written response.

Send it through a channel that produces proof of delivery. This written notice is especially important for an NPC complaint because the complainant must ordinarily first give the organization an opportunity to act.

Do not include passwords, one-time PINs, or unrelated sensitive records. Redact third parties’ unnecessary personal information when submitting copies.

How to complain to the SEC

The SEC is the primary regulator for lending and financing companies that are not supervised under another special regulatory regime. Its complaint process covers, among other matters, violations of the Lending Company Regulation Act, the Financing Company Act, the Truth in Lending Act, and rules against unfair collection.

Follow the SEC’s current complaint instructions for lending and financing companies:

Download and completely answer the official complaint form.
File one complaint form for each respondent company.
Attach a copy of a valid government-issued ID.
Attach the loan agreement, disclosure statement, repayment records, receipts, screenshots, messages, call logs, posts, and witness evidence.
Identify both the app brand and the legal company, if known.
Submit using the filing channel stated on the SEC complaint page. Verify the page before filing because addresses and channels may change.

The SEC ordinarily evaluates the complaint and may furnish it to the company for comment. The company is generally given ten days from receipt to answer under the process described on the SEC page. If sufficient grounds exist, the SEC may commence administrative proceedings.

The SEC can investigate and impose regulatory sanctions, but its complaint unit does not simply rewrite the loan, declare the contract void, cancel the obligation, or settle the account for the borrower. Contract validity, excessive interest, restitution, and damages may require a different proceeding depending on the facts.

Report the lender even if it appears unregistered. Include every clue that may identify it: payment-account name, phone numbers, website, app-store page, privacy notice, corporate name, and collection accounts.

How to file a privacy complaint with the NPC

Use the NPC route when the complaint concerns contact-list harvesting, unauthorized disclosure, public shaming, misuse of photographs, excessive permissions, unlawful retention, or another misuse of personal data.

Under the 2021 NPC Rules of Procedure, the ordinary process is:

Notify the company in writing. Clearly identify the privacy violation and request appropriate action.
Allow 15 calendar days from receipt. A formal complaint may proceed if the company gives no response within that period or fails to take timely and appropriate action.
Prepare a verified complaint. It must be written, signed, and verified in the form required by the Rules of Court.
Identify the parties. State your contact information and identify the respondent. If its identity is unknown, provide circumstances and evidence that may lead to identification.
Narrate the material facts. Explain what data was processed, how it was obtained or used, who received it, and why the processing was unlawful.
Attach supporting evidence. Include your correspondence with the company, proof of receipt, its response if any, screenshots, witness affidavits, privacy notices, app permissions, and loan records.
State the relief requested. This may include orders to stop unlawful processing, correct or erase data where legally proper, or other relief within the NPC’s authority.
Include a sworn certification against forum shopping. Disclose any other case involving the same issues and comply with the continuing duty to report a similar case learned of later.
Pay the applicable filing fee unless exempted or waived.
File through a mode currently authorized by the NPC.

The NPC may waive prior exhaustion for good cause or a serious violation, including situations involving grave and irreparable harm, the absence of an adequate remedy from the respondent, or patently illegal conduct. The request for waiver should state and prove the urgent circumstances rather than merely omit the prior notice.

Start with the NPC’s current File a Complaint page and use its official forms and instructions. Do not rely on old online posts for filing addresses, fees, or email procedures.

If continuing processing creates grave harm, review the NPC’s separate procedure for an application for a temporary ban on processing. This is not automatic and has evidentiary and procedural requirements.

When to report to cybercrime authorities

Go promptly to the PNP-ACG, NBI Cybercrime Division, or the nearest appropriate law-enforcement office when the evidence indicates conduct such as:

A credible threat of violence, abduction, sexual harm, or damage to property.
Extortion or a demand backed by a threat to publish private or fabricated material.
Unauthorized access to an account or device.
Identity theft or impersonation.
Fabricated government, police, prosecutor, or court documents.
Publication of defamatory accusations through a computer system.
Distribution of intimate images or sexualized fabricated images.
Fraudulent payment instructions or theft from an e-wallet or bank account.
Persistent harassment creating an immediate safety risk.

The precise offense depends on the exact words, acts, audience, intent, and evidence. Possible legal provisions may be found in the Revised Penal Code, the Data Privacy Act, and the Cybercrime Prevention Act of 2012. Not every rude message is automatically a cybercrime, and nonpayment of an ordinary loan does not by itself authorize arrest.

Bring:

A chronological incident summary.
Printed and electronic copies of the evidence.
The original device, when requested and safe to provide for examination.
Proof linking accounts or numbers to the collector.
Loan and payment records.
Witness details.
A government-issued ID.

Ask for the report, complaint, or reference number. Preserve the original files even after submitting copies. The PNP’s official cybercrime-reporting framework is described in its guidelines for reporting cybercrime and cyber-related incidents.

When the lender is a bank or BSP-supervised institution

If the lender is a bank, digital bank, electronic-money issuer, or another BSP-supervised financial institution:

First file a formal complaint through the institution’s consumer-assistance mechanism.
Keep the complaint reference number and its final response, if any.
If unresolved, escalate through the BSP’s current Consumer Assistance Mechanism.

The BSP route does not replace an NPC complaint for unlawful personal-data processing or a police report for suspected crime.

What happens to the debt?

Harassment and privacy violations do not automatically erase the principal, lawful interest, or other valid charges. Conversely, owing money does not surrender the borrower’s privacy rights or permit illegal collection.

While the complaint is pending:

Request an itemized statement of account.
Compare the amount released with the contract, disclosure statement, fees, interest, penalties, and payments.
Make payments only through a verified official channel.
Obtain and retain receipts.
Do not pay a personal account merely because a threatening caller supplied it.
If disputing part of the balance, state the dispute in writing without making unnecessary admissions.
If proposing settlement, require written terms and proof that the person negotiating is authorized.
After full payment, request written confirmation that the account is settled.

A borrower who believes the contract, interest, fees, or collection amount is unlawful should obtain advice based on the actual documents. The regulator receiving a harassment complaint may not have authority to resolve every contractual or monetary issue.

Evidence checklist

Preserve, where available:

Loan agreement and promissory note.
Truth-in-lending disclosure statement.
Amount approved and amount actually disbursed.
Complete schedule of interest, fees, and penalties.
Payment confirmations and bank or e-wallet records.
Full screenshots and screen recordings.
Original emails and message files.
Call logs and voicemail.
Social-media URLs, usernames, timestamps, and audience details.
App-store listing and developer identity.
Privacy notice and terms applicable when the loan was obtained.
App-permission screens.
Names and statements of contacted relatives, coworkers, or friends.
Written complaint to the lender and proof of receipt.
The company’s response.
SEC, NPC, BSP, platform, or police reference numbers.

Create a simple timeline matching each incident to its supporting file. This makes it easier for regulators or investigators to understand a campaign involving many phone numbers and accounts.

Common mistakes to avoid

Deleting the app or messages before preserving evidence. Important account and identity information may disappear.
Reporting only the app’s nickname. Identify the corporate lender, developer, collector, payment recipient, and other traceable details.
Submitting heavily cropped screenshots. Preserve sender information, timestamps, URLs, and context.
Filing a bare accusation. Describe who did what, when, where, through which account, and what data was disclosed.
Skipping written notice before an NPC complaint. Prior notice and the 15-calendar-day response period ordinarily apply unless the NPC waives them for proven good cause or seriousness.
Using outdated NPC procedures. The 2021 Rules repealed the NPC’s older 2016 complaint rules.
Assuming a regulatory complaint cancels the debt. Continue addressing any legitimate obligation through documented channels.
Threatening or publicly exposing collectors in return. This can create a separate legal dispute and compromise evidence.
Sending IDs or personal records to unverified accounts. Use official government channels and redact irrelevant information.
Paying out of fear to an unfamiliar personal account. Verify the creditor and payment channel first.
Naming unrelated people as respondents without evidence. Distinguish the company, collector, developer, and payment recipient based on available proof.

When legal help is urgent

Seek immediate assistance if:

A threat appears credible or the collector knows your real-time location.
Someone threatens your child, family, workplace, home, or physical safety.
Intimate or fabricated sexual material has been published or is about to be published.
Your accounts, SIM, email, e-wallet, or device may have been compromised.
The collector is impersonating law enforcement or using fabricated legal documents.
Personal data is spreading rapidly across public pages or group chats.
You need urgent injunctive or protective relief.
A summons, subpoena, prosecutor’s notice, or court document has actually been received.
The company is unidentified or appears to operate from outside the Philippines.
The amount, contract, or settlement documents are substantial or legally complex.

For an immediate physical threat, prioritize personal safety and contact emergency or local law-enforcement services. A barangay record may help document events, but it does not replace reporting a suspected cybercrime to the proper investigative agency.

Frequently asked questions

Can an online lender contact everyone in my phone?

No. NPC Circular No. 2020-01 prohibits accessing, harvesting, copying, or saving phone, email, or social-media contacts for debt collection or harassment. The app should instead provide a separate interface for borrower-selected character references or co-makers.

Can the lender call my employer or relatives?

A communication to an authorized co-maker, guarantor, or properly supplied reference must still be lawful and proportionate. Revealing the debt to unrelated persons or contacting them to shame or pressure the borrower may violate SEC collection rules and data-privacy requirements.

Is it legal to post my photograph and call me a scammer?

A lender cannot lawfully use a KYC photograph to embarrass or harass a borrower. Publicly accusing an identifiable person of a crime may also create privacy, civil, or criminal issues, depending on the statement, publication, evidence, and circumstances.

Can a collector threaten me with arrest for an unpaid loan?

A collector must not falsely claim that arrest is automatic or that a warrant or criminal case exists when it does not. Ordinary inability to pay a contractual debt is not, by itself, imprisonment for debt. Fraud, falsification, issuance of a bad check, or another independently defined offense requires its own facts and legal elements.

Must I wait 15 days before approaching the NPC?

Ordinarily, you must notify the company in writing and allow 15 calendar days from receipt for an appropriate response. The NPC may waive this requirement upon properly alleged and proven good cause or when the violation is serious, such as where grave and irreparable harm requires urgent intervention.

Can I complain even if the lender is unregistered?

Yes. NPC Circular No. 2020-01 covers persons processing data for loan transactions whether or not they possess the required SEC authority. Give regulators enough information to identify or trace the operator.

Can a person who was merely contacted file a complaint?

A person whose own personal data was unlawfully processed or who was personally affected may have an independent privacy complaint. The borrower and contacted person should each preserve the messages they personally received. Representation before the NPC requires proper authority under its rules.

Will the SEC or NPC negotiate my loan balance?

Do not assume so. The SEC states that its complaint process cannot simply change payment terms, void the contract, cancel the obligation, or settle the loan. The NPC focuses on personal-data protection. Monetary and contractual disputes may require negotiation, another agency process, or court action.

Should I block the collector?

Preserve complete evidence first. You may then block abusive accounts as a safety measure, while keeping at least one documented channel for legitimate account statements or settlement discussions if appropriate.

Can I file with the SEC, NPC, and police at the same time?

Potentially, yes, because their jurisdictions differ. Disclose related proceedings where required—particularly in the NPC certification against forum shopping—and ensure that each complaint accurately states what has already been filed.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Liability, jurisdiction, deadlines, and available remedies depend on the actual messages, loan documents, parties, and evidence. Official sources and procedures were checked as of August 24, 2026.