Quick answer

If an online lending app threatens, insults, publicly shames, deceives, or contacts people who did not agree to guarantee your loan, preserve the evidence and report it through the proper channels:

Send a written complaint to the lender’s consumer-assistance unit and data protection officer (DPO).
Report unfair collection practices to the Securities and Exchange Commission (SEC) through iMessage, under the Financing and Lending Companies Department.
File a privacy complaint with the National Privacy Commission (NPC) if personal data was unlawfully accessed, used, retained, or disclosed.
Report threats, fraud, blackmail, impersonation, or other possible crimes to the DICT Cyber Hotline, NBI Cybercrime Division, or PNP Anti-Cybercrime Group. Call 911 if anyone faces immediate danger.

These remedies may be pursued for different aspects of the same incident. However, disclose related proceedings when a complaint form requires it. Reporting harassment does not automatically cancel a valid loan, suspend payments, or erase lawful collection rights.

The government’s March 2026 joint advisory on online lending platforms applies to lending and financing companies and other entities offering or facilitating loans online, whether their platforms are recorded or unrecorded.

What collection conduct is prohibited?

A lender or collection agent may use reasonable and lawful methods to collect an amount that is actually due. Collection becomes potentially unlawful when it involves conduct prohibited by the SEC’s rules on unfair debt collection, the Data Privacy Act, or other applicable laws.

Prohibited or reportable conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property
Threatening an action that cannot legally be taken
Using obscenities, insults, or profane language that abuses the borrower or may constitute an offense
Publishing or disclosing a borrower’s name, photograph, loan information, or other personal data to shame the borrower, except where disclosure is lawfully permitted
Sending false loan information or using deceptive representations to collect a debt or obtain information
Creating group chats with relatives, friends, co-workers, or strangers to announce the alleged debt
Posting “wanted” notices, funeral-style images, altered photographs, or accusations on social media
Contacting people in the borrower’s phonebook for debt collection when they are not properly consenting guarantors or co-makers
Treating a character reference as though that person guaranteed the loan
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been overdue for more than 15 days or the borrower expressly agreed that those are the only reasonable or convenient contact times
Continuing excessive or disproportionate processing of contacts, photographs, device information, or other personal data

The Financial Products and Services Consumer Protection Act also prohibits abusive collection or debt-recovery practices. A financial service provider cannot necessarily avoid responsibility by outsourcing collection: the Act addresses responsibility for representatives and solidary liability with accredited third-party service providers.

Character references are not automatically guarantors

A character reference is normally provided to help verify the borrower’s identity or the truthfulness of application information. Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

The reference must be told that their details were provided and how those details were obtained.
The reference must be given an option to have their data removed as a character reference.
A reference cannot automatically be treated as a guarantor.
A guarantor must separately and expressly consent to assume responsibility if the borrower defaults.
For debt collection, the lender may contact the properly consenting guarantor—not everyone in the borrower’s contact list.

A person whose number happened to be stored in the borrower’s phone is not made liable for the loan by that fact alone.

What access to your phone is allowed?

The law does not impose an absolute ban on every app permission. The question is whether the permission and resulting processing are lawful, transparent, necessary, and proportionate.

An online lending platform may have a limited basis to:

Use the camera or a photograph for identity verification, know-your-customer checks, or a similarly specified legitimate purpose
Let the borrower select a character reference or guarantor
Derive proportionate metadata from contacts when genuinely necessary for a specified legitimate purpose

It may not engage in unrestrained harvesting, copying, or use of an entire contact list to pressure the borrower. A borrower’s photograph must not be used for harassment or public shaming. Once the legitimate purpose of a permission has been achieved and no other lawful basis remains, the platform should prompt the user to revoke or turn off that permission.

Consent is not a blanket defense. Personal-data processing must still follow the Data Privacy Act’s principles of transparency, legitimate purpose, and proportionality. Pre-ticked permissions, concealed alternatives, or interfaces that make consent easy to give but difficult to withdraw may undermine valid consent.

Preserve evidence before blocking or uninstalling the app

Do not delete messages or uninstall the app until you have safely captured the available evidence. Preserve:

Full screenshots showing the message, sender’s number or account, date, and time
Screen recordings of message threads, app pages, public posts, and group chats
Original SMS, chat exports, emails, voice messages, recordings lawfully obtained, and call logs
Direct URLs and account names for social-media posts
The app-store listing, developer name, app version, website, and privacy notice
Screens showing the permissions requested or granted
The loan agreement, disclosure statement, repayment schedule, account statement, and payment receipts
The app’s brand name and the full corporate name of the lender
Names or identifying details used by collectors
Screenshots received by family members, friends, employers, or co-workers
Written statements or affidavits from people who were contacted
Your complaint to the lender and proof of delivery
The lender’s response, if any
A dated chronology describing each incident and its effect

Keep original files and make at least one backup. Avoid editing, annotating, or repeatedly compressing the only copy. If you need marked-up copies for explanation, retain the untouched originals as well.

Ask affected contacts to preserve evidence from their own devices. Their screenshots can show the actual recipient, sender, date, time, and disclosure more clearly than a forwarded image.

Secure your accounts and warn affected contacts

After preserving evidence:

Revoke unnecessary permissions for contacts, camera, photographs, storage, microphone, location, and social-media access.
Change passwords for affected email, financial, and social-media accounts.
Enable multi-factor authentication where available.
Check whether unfamiliar recovery numbers, devices, or forwarding rules were added to your accounts.
Tell contacts not to provide information, click links, send identification documents, or pay anyone claiming to collect your loan.
Verify repayment instructions through the lender’s official channel. Do not send money to an unknown collector’s personal account.
If banking or e-wallet credentials may have been exposed, contact the provider immediately and secure or restrict the account.

Uninstalling the app stops future access through the app but does not necessarily delete data already collected. It also does not extinguish the loan.

Send the lender a written complaint

Send a concise written notice to both the lender’s consumer-assistance unit and its DPO. Their contact details may appear in the app, loan agreement, privacy notice, website, or disclosure statement.

Include:

Your name and enough account information to identify the loan
The app name and lender’s corporate name
A chronological description of the conduct
The telephone numbers, accounts, or collectors involved
The names of people contacted and what was disclosed
The personal data accessed, copied, used, or published
Copies of the strongest evidence
Whether the amount or account itself is disputed
The specific action you want taken

You may request that the company:

Stop threats, insults, public shaming, and contact-list collection
Remove unlawful public posts and group-chat disclosures
Restrict further communications to

Quick answer

If an online lending app threatens, insults, publicly shames, or contacts people in your phone to collect a debt, preserve the evidence and report the conduct through the proper channels:

Write to the lender, its consumer-assistance unit, and its data protection officer (DPO). Demand that the prohibited conduct stop and ask for a written response.
Report unfair debt collection to the Securities and Exchange Commission (SEC) through iMessage under the Financing and Lending Companies Department.
File a privacy complaint with the National Privacy Commission (NPC) if personal data was harvested, misused, or disclosed. Ordinarily, first notify the lender in writing and allow it to act. If it gives no response within 15 calendar days, or its action is not timely or appropriate, proceed with the formal NPC complaint. The NPC may waive this requirement for good cause or a serious violation involving a risk of harm.
Report threats, fraud, blackmail, impersonation, or possible cybercrime immediately to the DICT Cyber Hotline, NBI Cybercrime Division, PNP Anti-Cybercrime Group, or the nearest police station. Call 911 if anyone is in immediate danger.

Reporting harassment does not automatically cancel a legitimate loan, suspend collection, or erase the balance. It challenges the collection method or misuse of data, not necessarily the debt itself.

What online lenders are prohibited from doing

A lender may use reasonable and legally permissible means to collect an amount that is actually due. It may send proper reminders, demand payment, negotiate a repayment plan, use an authorized collection agency, or pursue a lawful court action.

Collection crosses the line when it uses abusive, deceptive, or privacy-invasive methods. Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices include:

Using or threatening violence or another criminal act against a person, reputation, or property
Threatening an action that cannot legally be taken
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense
Publishing or disclosing the name or personal information of someone alleged to have refused payment, except where a lawful disclosure is permitted
Giving another person false loan information or failing to disclose that a debt is disputed
Using a false representation or deceptive method to collect or obtain information
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been past due for more than 15 days or the borrower expressly agreed that those hours are the only reasonable or convenient time for contact
Contacting people in the borrower’s phone contact list who are not properly designated guarantors or co-makers

A lender cannot avoid responsibility simply by using a third-party collection agency. The Financial Products and Services Consumer Protection Act prohibits abusive collection and makes financial service providers responsible for the acts or omissions of their representatives. It also provides for solidary liability with accredited third-party service providers for relevant acts or omissions.

Contact lists, character references, and guarantors are different

A character reference does not become responsible for a loan merely because the borrower entered that person’s number in an app.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

A character reference is used to verify the borrower’s identity or the truthfulness of information supplied in the application.
A character reference must be told that they were selected, informed how their details were obtained, and offered a way to have their data removed as a reference.
A character reference cannot automatically be treated as a guarantor or contacted for debt collection.
A guarantor must separately and expressly consent to assume responsibility if the borrower defaults.
For debt collection, the lender may contact a genuine guarantor. It may not indiscriminately call or message relatives, friends, colleagues, employers, or other contacts.

The government’s March 18, 2026 joint advisory on online lending platforms confirms that contacting people in a borrower’s contact list, other than consenting guarantors, is prohibited.

When app permissions become a privacy violation

An online lender is not automatically prohibited from requesting every device permission. The permission must, however, be necessary, proportionate, properly explained, and connected to a lawful purpose.

For example:

Camera or photo access may be used for identity verification, know-your-customer procedures, or a similar specified purpose.
Contact access may be narrowly used to let the applicant select a character reference or guarantor, or to derive proportionate metadata for a specified legitimate purpose.
Once the purpose has been completed and no other lawful basis applies, the app should prompt the user to revoke or disable the permission.
Photos cannot be altered or circulated to shame a borrower.
Contact information cannot be copied or used for indiscriminate debt collection.
Personal data cannot be processed excessively, indefinitely, or for an unrelated purpose merely because the user once tapped “Allow.”

The Data Privacy Act of 2012 requires transparency, legitimate purpose, and proportionality. Consent is not a blanket excuse for excessive processing, public shaming, or harassment. Pre-ticked permissions, hidden alternatives, or interfaces that make consent easy to give but difficult to withdraw may also undermine valid consent.

Borrowers may request information about the data being processed, its source, purpose, recipients, and retention period. They may also request correction, blocking, or erasure when legally justified. Erasure is not absolute: a lender may retain information needed to administer an active loan, comply with law, or establish, exercise, or defend legal claims.

Preserve evidence before blocking or uninstalling the app

Do not rely on memory or delete the messages in anger. Save evidence in its original form as far as possible.

Preserve:

Full screenshots showing the message, sender’s number or account, date, and time
The complete conversation—not only the most offensive line
Original SMS, chat exports, emails, voice messages, recordings lawfully obtained, and call logs
Screen recordings showing the app name, developer, account page, permissions, privacy notice, and offending content
The app-store listing, website address, download link, app version, and developer information
Loan agreement, disclosure statement, repayment schedule, statements of account, receipts, and transaction references
The app brand and the full corporate name of its operator
Names or numbers used by collection agents and any agency they claim to represent
Copies of posts, group messages, altered photos, funeral-style notices, or other public-shaming material, including their URLs
Screenshots and statements from relatives, coworkers, or other people contacted
Your written complaint to the lender and proof that it was delivered
A dated chronology listing each incident, person contacted, and response received

Keep an untouched backup. Avoid cropping, annotating, or editing the only copy. If another person received the message, ask that person to preserve it on their own device and write down how and when it was received. Electronic evidence may need to be authenticated later.

Once evidence is secured, revoke unnecessary app permissions, change compromised passwords or PINs, enable multi-factor authentication, and uninstall the app if appropriate. Uninstalling does not erase information already held by the lender or cancel the loan.

Send a written complaint to the lender first

Send the complaint to both the lender’s consumer-assistance channel and the DPO identified in its app, contract, website, or privacy notice. Use email or another method that produces proof of delivery.

Include:

Your name and enough account information to identify the loan
The app’s name and corporate operator
A chronological description of what happened
The numbers, accounts, or collectors involved
The personal data accessed, used, or disclosed
The names of third parties contacted
Copies of the strongest evidence
Whether you dispute the debt, the amount, or only the collection conduct
The specific action you want

You may request that the lender:

Stop threats, insults, public shaming, and contact-list collection
Stop contacting anyone who is not a consenting guarantor or co-maker
Communicate with you only through a specified reasonable channel
Identify the company and collection agency responsible
Explain what personal data it holds, where the data came from, and who received it
Correct inaccurate information
Remove or block data that no longer has a lawful purpose, subject to lawful retention requirements
Preserve relevant records, call logs, instructions, and collector information
Investigate and provide a written response

State the date of your notice. For an NPC complaint, retain proof that the respondent received it and count 15 calendar days from receipt if no response is given. Do not wait where there is immediate danger, ongoing blackmail, identity theft, or another urgent risk.

Where to report each type of violation

Problem	Primary reporting route
Unfair or abusive collection by a lending or financing company, including an unrecorded online lending platform	SEC Financing and Lending Companies Department
Harvesting, excessive processing, public disclosure, or misuse of personal data	National Privacy Commission
Threats, blackmail, fraud, impersonation, hacking, or other possible crimes	DICT Cyber Hotline, NBI, PNP, or local police
Conduct by a bank, digital bank, e-money issuer, or another BSP-supervised institution	Institution’s consumer-assistance unit first, then BSP
Immediate threat to life, physical safety, or property	911

One incident may justify reports to more than one office because the agencies address different issues. Disclose related formal cases when a complaint form or certification requires it; do not conceal another case involving the same issues.

How to report unfair collection to the SEC

Use the SEC’s iMessage ticketing system. Select the service for complaints involving financing and lending companies under the Financing and Lending Companies Department.

In the complaint:

Identify both the app and its corporate operator. If the operator is unknown, provide the app-store developer, website, payment-account details, telephone numbers, and other identifying information.
State the loan date, amount, due date, and relevant account information.
Describe each prohibited act with dates and times.
Identify the collector or third-party agency if known.
Attach the loan documents, communications, third-party messages, and proof of your complaint to the lender.
Save the SEC ticket number and acknowledgement.

The 2026 joint advisory also lists the SEC hotline as 1-4732 (1-4SEC). Report an app even if it appears unregistered or is no longer available in the app store. An unrecorded platform’s status does not make threats, public shaming, or unlawful data use acceptable.

An SEC complaint does not by itself cancel the loan or authorize the borrower to ignore a legitimate balance. Continue to document payments and communicate about any undisputed amount through the lender’s verified official channels.

How to file a formal privacy complaint with the NPC

A formal NPC case requires more than an informal email describing the problem.

1. Complete the current complaint form

Download the NPC’s Complaint-Affidavit dated March 1, 2026. Complete its questionnaire, narration, list of evidence, requested relief, verification, and certification against forum shopping. Attach a valid government-issued ID and the supporting documents identified in the form.

The complaint must be signed, verified, and notarized. Clearly identify the respondent. If the company name is unknown, provide facts that may enable the NPC to identify it.

2. Show prior written notice—or explain why it was unsafe or ineffective

Under the 2021 NPC Rules of Procedure, as amended, ordinarily you must prove that:

You informed the lender or other responsible entity of the privacy violation in writing; and
It failed to take timely or appropriate action, or gave no response within 15 calendar days after receipt.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. If you did not contact the respondent first, explain the specific reason and attach supporting proof.

3. Attach evidence

Failure to attach evidence may cause outright dismissal. Organize exhibits and label them consistently—for example, “Annex A: Screenshot of message dated…,” “Annex B: Message received by coworker…,” and “Annex C: Written notice and delivery receipt.”

4. File through an authorized channel

The NPC’s formal-complaint page permits submission in person, by registered mail or courier, or by scanning and emailing the complaint to complaints@privacy.gov.ph. Follow the current form and NPC instructions, particularly for original documents and payment.

The base filing fee under NPC Circular No. 2023-01 is ₱500, plus applicable charges. Additional fees apply to claims for damages and certain special applications. Qualified indigent complainants may seek an exemption by submitting the required proof.

There is no single safe filing deadline for every possible privacy, civil, administrative, or criminal claim. Prescription may depend on the specific violation and remedy. File promptly and obtain legal advice if the incident is old or substantial damages are involved.

Reporting threats, fraud, and possible cybercrime

The SEC and NPC handle regulatory and privacy issues, but they do not replace emergency services or criminal investigation.

The March 18, 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

You may also go to the nearest police station or NBI office. Call the nationwide 911 emergency hotline for an immediate threat to life, safety, or property.

A threat, false accusation, blackmail demand, identity takeover, or malicious online publication may involve criminal law depending on its exact words, context, intent, and evidence. Do not label a specific crime as proven in your complaint. Describe exactly what happened and allow investigators and prosecutors to determine the proper charge.

The Constitution provides that no person may be imprisoned merely for debt. A collector’s threat of automatic arrest solely because a loan remains unpaid is therefore misleading. This does not protect someone from investigation for a separate alleged offense supported by evidence. See Article III, Section 20 of the 1987 Constitution.

If the lender is supervised by the BSP

Some digital credit products are offered by banks, digital banks, e-money issuers, or other Bangko Sentral ng Pilipinas-supervised institutions rather than ordinary SEC-regulated lending companies.

First submit the complaint to the institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, escalate it through the BSP Consumer Assistance Mechanism:

Use the BSP Online Buddy or BOB
Submit the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph
Call (02) 5306-2584
File by mail or personally through the BSP consumer-assistance channels

Attach your complaint to the institution, its reply if any, and the supporting documents. The BSP states that email or postal submissions are evaluated and, when necessary, responded to or referred to the supervised institution within seven banking days.

Common mistakes that weaken a complaint

Deleting messages or uninstalling the app before preserving evidence
Submitting cropped screenshots that omit the sender, date, or surrounding conversation
Naming only the app brand and not attempting to identify its corporate operator
Failing to distinguish a disputed balance from abusive collection conduct
Filing an NPC complaint without prior written notice or a documented reason for requesting a waiver
Filing a privacy complaint without supporting evidence
Ignoring messages sent to relatives, coworkers, or references instead of asking those recipients to preserve them
Paying a collector’s personal account without verifying that it is an authorized payment channel
Publishing the collector’s personal information or retaliating with threats
Assuming that a regulator’s acknowledgement means the debt has been cancelled or that a violation has already been proven
Ignoring an official court summons, government order, or deadline because a regulatory complaint is pending
Hiding another case involving the same issues when signing a certification against forum shopping

When legal help is urgent

Speak to a Philippine lawyer promptly if:

The collector threatens physical harm, abduction, sexual violence, or a visit to your home or workplace
Intimate, sexualized, altered, or highly sensitive images are being circulated
A child’s information is involved
Your identity, bank account, e-wallet, SIM, or government credentials may have been compromised
The lender has sued you or you received a subpoena, summons, or official order
You want damages, a temporary ban on processing, a cease-and-desist order, or emergency court relief
Several agencies or cases involve the same facts
The operator is offshore, unidentified, or using multiple shell companies and payment accounts
The incident is old and a prescriptive period may be approaching

If you cannot afford private counsel, inquire with the Public Attorney’s Office, the Integrated Bar of the Philippines legal-aid program, or a recognized law-school legal-aid clinic about eligibility and available assistance.

Frequently asked questions

Can an online lender message my family, friends, or coworkers?

Not for indiscriminate debt collection. A genuine guarantor who separately agreed to be responsible may be contacted. A character reference is not automatically a guarantor and should not be pursued for payment.

Can the lender post my name, photo, or debt on social media?

Public shaming and unnecessary disclosure of borrower information are generally prohibited. A lawful disclosure to a regulator, court, credit-information entity, authorized service provider, or another recipient permitted by law is different from posting the borrower’s information to embarrass them.

Does tapping “Allow contacts” make everything legal?

No. Processing must still be transparent, lawful, necessary, and proportionate. Permission to select a reference does not authorize copying the entire contact list and using it for harassment.

Can a person contacted as a reference file their own complaint?

Yes, if that person’s own data was collected, misused, or disclosed, or the person was directly subjected to the conduct. They should preserve the messages and explain how their number was obtained and used.

Should I stop paying after reporting the lender?

A report does not automatically extinguish or suspend a valid debt. Verify the lender and amount, dispute errors in writing, and make legitimate payments only through confirmed official channels. Ask for a written restructuring proposal if you cannot pay as scheduled.

Can I demand deletion of all my data?

You may request erasure or blocking where legally justified, but the lender may retain information necessary for an active account, compliance obligations, or legal claims. It should explain the lawful basis and retention period.

What if the app has disappeared or appears unregistered?

Report it to the SEC and provide the app link, screenshots, developer name, website, phone numbers, payment accounts, and collection messages. Also report threats, fraud, or impersonation to cybercrime authorities. The 2026 government advisory covers recorded and unrecorded online lending platforms.

Do I need a lawyer to complain?

A lawyer is not ordinarily required to submit an SEC ticket or complete the NPC complaint form. Legal assistance becomes especially valuable for urgent relief, damages, criminal complaints, court proceedings, prescription issues, or overlapping cases.

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the loan documents, communications, identities of the parties, evidence, and applicable regulator. Official sources and procedures were checked as of August 5, 2026.