Quick answer

Report abusive collection to the regulator supervising the lender and report misuse of personal data to the National Privacy Commission (NPC). For most online lending apps operated by lending or financing companies, the regulator is the Securities and Exchange Commission (SEC).

A practical sequence is:

Preserve the messages, call logs, app details, loan documents, and proof of disclosure to other people.
Send the lender and its data protection officer a written complaint demanding that the harassment and unauthorized disclosure stop.
File an unfair-collection complaint through the SEC iMessage portal.
If personal data was accessed, disclosed, or used improperly, file a formal complaint with the NPC. Ordinarily, you must first give the lender written notice and allow 15 calendar days for an appropriate response.
For credible threats, extortion, stalking, doxxing, or other possible crimes, contact the police or NBI immediately. Call 911 if anyone is in immediate danger.

An unpaid loan may still be legally collectible. It does not give a lender or collection agency permission to threaten, shame, deceive, or misuse personal data.

What conduct may be unlawful?

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, prohibits abusive collection or debt-recovery practices and requires financial service providers to respect client privacy and provide a free consumer-assistance mechanism.

For SEC-regulated lending and financing companies, SEC Memorandum Circular No. 18, series of 2019, identifies practices such as:

Threatening or using violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscene, insulting, or profane language that abuses the borrower or amounts to an offense.
Publishing or improperly disclosing a borrower’s name or personal information.
Communicating loan information known, or which should be known, to be false, including failing to disclose that a debt is disputed when applicable.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting a borrower at unreasonable hours—generally before 6:00 a.m. or after 10:00 p.m.—subject to the circular’s exceptions for accounts more than 15 days overdue or when the borrower agreed to another time through written, electronic, or recorded means.
Contacting people in the borrower’s phone contacts who were not named as guarantors or co-makers.

Outsourcing collection does not necessarily shield the lender. Under Section 13 of RA 11765, a financial service provider is responsible for the acts or omissions of its employees and agents and may be solidarily liable with an accredited third-party service provider involved in debt collection.

Legitimate collection is still allowed

A lender may ordinarily:

Send accurate and respectful payment reminders.
State the correct amount and consequences provided by the contract and law.
Send a formal demand.
Negotiate a payment arrangement.
Refer the account to a legitimate collection agency or lawyer.
File an appropriate civil action.

Ordinary inability or failure to pay a debt is not, by itself, authority to arrest a borrower. However, separate conduct—such as fraud or issuing a bad check under circumstances covered by law—may create a different legal issue. Do not ignore genuine court papers or assume that every reference to legal action is automatically harassment.

When use of phone contacts becomes a privacy violation

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal-data processing to have a lawful basis and to observe transparency, legitimate purpose, and proportionality. Data subjects have rights that include access, correction, objection or blocking in appropriate cases, complaint, and indemnification for qualifying harm.

The detailed rules for lenders appear in NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02.

Those rules prohibit unbridled, excessive, or disproportionate contact-list processing, including processing that:

Leads to harassment.
Is used to collect from people other than the borrower’s guarantors.
Results in unfair collection practices.

An app may be allowed limited access necessary for a borrower to select a character reference or guarantor. The amended rules also recognize narrowly limited processing of proportional contact-list metadata when the legal requirements are met. That is not permission to copy an entire address book and message everyone in it.

Important distinctions include:

A character reference is not automatically a guarantor.
A character reference is generally for verifying the borrower’s identity and the truth of information supplied during the application.
The lender must tell the reference how the contact information was obtained and provide an option to have the reference’s data removed.
A guarantor must separately and expressly agree to undertake the guaranty in accordance with law.
For debt collection, the lender may contact the guarantor—not unrelated contacts or a character reference who never became a guarantor.

Tapping “Allow Contacts” does not legalize harassment. App permission is a technical device setting, not blanket consent to excessive collection, public shaming, or processing for an incompatible purpose.

Preserve evidence before blocking or uninstalling the app

Create a secure evidence folder and keep the original files where possible. Preserve:

Complete screenshots of texts, chats, posts, emails, and notifications, including the date, time, sender, URL, username, and phone number.
Screen recordings showing the full conversation and account profile.
Call logs and any lawful recordings already in your possession.
Voicemails and audio messages.
Copies of messages received by relatives, co-workers, employers, or other contacts.
Short signed statements from those contacts explaining what they received, when, and from whom.
The app’s name, developer, store listing, privacy policy, website, package name, and version.
Screenshots of the permissions requested or granted to the app.
The loan agreement, disclosure statement, payment history, receipts, account number, and collection notices.
The collector’s claimed name, company, agency, contact details, and payment instructions.
Your written complaint to the lender, proof that it was received, and every response.
Any public post before it is removed, together with its URL and visible audience or group.

Do not crop away identifying context. Keep an unedited copy and use redacted copies when sharing evidence outside official proceedings. Avoid reposting threats or exposing other people’s phone numbers on social media.

After preserving the evidence, review and revoke unnecessary contacts, camera, location, microphone, photo, and storage permissions. Change compromised passwords, enable multi-factor authentication, and check whether the app was given accessibility, device-administrator, or notification-reading access. Uninstalling immediately may erase useful local evidence, so document the app first unless leaving it installed creates an urgent security risk.

Send a written complaint to the lender

Use the consumer-assistance and data-protection contacts in the loan agreement, app, privacy notice, or lender’s official website. Send the complaint through a channel that produces proof of delivery.

Your notice should identify:

Your name and loan or account reference.
The app brand and legal company name.
Each incident, with dates, times, numbers, accounts, and recipients.
The exact information disclosed or accessed.
Why you dispute the conduct.
Whether the amount itself is disputed.
The action you want taken.

You may request that the company:

Stop abusive communications and third-party contact.
Confirm the identity and authority of the collector.
Investigate its employee or collection agency.
Identify the source, recipients, purpose, and legal basis for processing your personal data.
Correct false information.
Block or remove unlawfully processed information where the legal requirements for blocking or removal are met.
Preserve relevant call recordings, access logs, collection notes, and communications.
Give a written response and complaint reference number.

Keep the privacy complaint separate from any payment proposal. Do not admit an amount you genuinely dispute merely to stop the harassment. Conversely, a privacy complaint should not be presented as proof that a valid loan has disappeared.

File with the SEC

Use the SEC iMessage portal, the SEC’s current centralized system for inquiries and complaints. Register or sign in, open a ticket, select the category relating to lending or financing, and attach your evidence. Keep the ticket number and monitor the portal.

Identify both:

The app’s public or trade name; and
The corporation operating the app, as shown in the agreement, privacy notice, app-store listing, payment account, or SEC record.

You can check whether a corporation is registered through Check with SEC. Corporate registration alone does not prove that it has a current Certificate of Authority to operate as a lending or financing company, so state in your complaint if its authority or identity cannot be verified.

A useful SEC complaint contains:

A short chronological account.
The loan and collector details.
The particular threats, insults, disclosures, deception, unreasonable-hour contacts, or third-party messages.
Copies of the original evidence.
The name and contact details of every non-guarantor who was contacted, with that person’s permission.
Your written complaint to the company and its response.
The relief requested, such as investigation and cessation of the prohibited practice.

SEC Memorandum Circular No. 18 provides escalating administrative sanctions. First-offense fines begin at ₱25,000 for a lending company and ₱50,000 for a financing company; later violations may result in higher fines and, depending on the facts and gravity, suspension or revocation of authority. RA 11765 also provides separate sanctions for willful violations, but liability and the applicable penalty must be established through the proper proceeding.

File a privacy complaint with the NPC

Complete the 15-day prerequisite

Under the 2021 NPC Rules of Procedure, a formal complaint ordinarily will not be given due course unless you establish that:

You informed the lender, collector, personal information controller, or concerned entity in writing about the privacy violation; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your written notice.

The NPC may waive these requirements for properly established good cause or a serious violation, including grave and irreparable harm that only NPC action can prevent or mitigate, the absence of a plain and adequate remedy, or conduct that is patently illegal. Explain and document the urgency if requesting a waiver; do not simply omit the prerequisite.

Prepare the formal complaint

Use the complaint form and current instructions on the NPC’s filing page. The complaint must generally be written, signed, verified, and notarized. It should include:

Your identity and contact information.
The respondent’s legal identity and service details, if known.
A clear narration of the material facts.
The Data Privacy Act or NPC rules allegedly violated.
The relief requested.
Your correspondence with the respondent and proof of the response or lack of response.
Documentary evidence and supporting witness affidavits, where available.
A sworn certification against forum shopping.

A representative needs appropriate authority, ordinarily a special power of attorney. The NPC’s filing page also links its current schedule of fees and identifies available exemptions or possible waiver procedures.

The NPC currently accepts complaints in person, by courier, or as a scanned submission to complaints@privacy.gov.ph, subject to its filing requirements. Confirm the current address, number of copies, fee, and payment procedure on the filing page immediately before submitting.

When another regulator is responsible

Do not assume every lending app is SEC-regulated.

Lending or financing company, online lending platform, or its collection agency: SEC.
Bank, digital bank, non-bank electronic-money issuer, pawnshop, or another BSP-supervised institution: Complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, escalate through the BSP Online Buddy or the channels in the BSP’s current complaint guide.
Cooperative offering credit: Cooperative Development Authority, subject to the particular institution and product.
Personal-data misuse by any of these entities: NPC may have jurisdiction over the privacy issue even when another regulator handles the financial-service complaint.

If uncertain, identify the legal company behind the app and ask the SEC or BSP to confirm the proper regulator.

Report threats and possible crimes promptly

Regulatory complaints do not replace a police or criminal complaint. Seek immediate law-enforcement help when messages involve:

A credible threat of physical harm, abduction, or property damage.
Extortion or a demand for money in exchange for not releasing personal information.
Stalking, an announced home or workplace confrontation, or publication of an address.
Impersonation of police, courts, lawyers, or government officials.
Fabricated warrants, summonses, or criminal cases.
Unauthorized account access, identity theft, or fraudulent transactions.
Dissemination or threatened dissemination of intimate images.

Call the government’s Unified 911 hotline during an immediate, life-threatening emergency. For cyber-enabled offenses, you may also use the NBI online complaint facility or approach the NBI Cybercrime Division, an NBI regional office, or the nearest police station.

Depending on the proven facts, conduct may fall under the Revised Penal Code, the Data Privacy Act, or another statute. Under Section 6 of the Cybercrime Prevention Act, an existing crime committed through information and communications technology may carry the higher penalty specified by that law. The correct offense cannot be determined from an alarming message alone; intent, wording, context, identity, and evidence matter.

Common mistakes to avoid

Naming only the app. Include the corporate operator and collection agency where identifiable.
Writing only “I was harassed.” List each act, date, sender, recipient, and supporting file.
Deleting everything before preserving evidence.
Submitting edited screenshots without retaining the originals.
Skipping the written notice required before an ordinary NPC complaint.
Assuming every use of contacts is automatically illegal. Limited processing may be allowed, but unbridled access, harassment, and collection from non-guarantors are prohibited.
Assuming app permission validates every later use of the data.
Paying a personal account supplied by an unverified collector. Confirm payment instructions through the lender’s official channel.
Posting IDs, loan documents, or other people’s numbers publicly.
Ignoring genuine court papers. Verify them directly with the named court or obtain legal assistance.
Waiting too long. Evidence and electronic records can disappear, and different claims have different prescriptive periods. Claims under RA 11765 generally prescribe five years from consummation of the transaction or discovery of deceit or material nondisclosure, with a ten-year outer limit; other legal claims may have much shorter periods.

When legal help is especially important

Consult a lawyer or the Public Attorney’s Office, if eligible, when:

Threats are credible or continuing.
Sensitive information has been widely published.
The lender disputes your identity or claims a loan you never obtained.
A collector is demanding payment through extortion or impersonation.
You need urgent injunctive or protective relief.
You received a subpoena, summons, complaint, or other court document.
Significant financial, employment, medical, or reputational harm has occurred.
Multiple complaints involving the same facts are pending before agencies or courts.
You need to claim damages or evaluate possible criminal charges.

Frequently asked questions

Can a lending app contact my family, employer, or friends?

It generally cannot disclose your debt to unrelated people or contact phone-list entries for collection. A person who separately and validly agreed to be a guarantor may be contacted. A character reference is not automatically a guarantor and should not be used as a collection target.

What if I allowed access to my contacts?

That does not authorize unbridled processing, harassment, public shaming, or collection from non-guarantors. The purpose, necessity, proportionality, notice, and applicable lawful basis still matter.

Can I report harassment even if the loan is overdue?

Yes. The debt and the collection method are separate issues. A valid debt may remain payable while the collector is investigated for abusive conduct or privacy violations.

Will filing a complaint cancel my loan?

No. SEC, NPC, BSP, police, and court proceedings address different violations and remedies. Unless the debt is invalidated, paid, settled, or otherwise legally discharged, filing a complaint does not by itself erase it.

May the lender post my name, photo, or debt on social media?

Public shaming and improper disclosure of borrower information may violate SEC collection rules and data-privacy law. Preserve the post, URL, date, account name, and visible audience before requesting removal.

Do I need a lawyer to complain?

A lawyer is not normally required to open an SEC ticket or send the lender a written complaint. An NPC complaint may also be filed personally, but it has formal verification, notarization, evidence, fee, and certification requirements. Legal assistance is advisable when the facts are complex, urgent relief is needed, or criminal or civil proceedings are being considered.

Can a person contacted as a reference file a complaint?

Yes, if that person’s own personal data was improperly processed or the person was harassed. The borrower and contacted person should preserve their respective evidence and may have separate claims.

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. Rights, jurisdiction, and remedies depend on the lender’s legal identity, the agreement, the actual communications, and the available evidence. Primary sources and official complaint channels were checked on 6 August 2026.