Quick answer

If an online lending app threatens you, publicly shames you, misuses your photo, accesses or messages your contacts, or reveals your loan to people who did not agree to be guarantors, preserve the evidence and report the conduct through the appropriate channels:

Securities and Exchange Commission (SEC): For abusive or unfair collection by lending companies, financing companies, online lending platforms, and their collection agents. File through the official SEC iMessage portal under Financing and Lending Companies Department → Complaints on Financing and Lending Companies.
National Privacy Commission (NPC): For unauthorized, excessive, or unlawful collection, use, disclosure, or retention of personal data. Ordinarily, first send the lender or its data protection officer a written complaint and allow 15 calendar days for an appropriate response. Then follow the NPC’s formal complaint procedure.
PNP, NBI, or DICT Cyber Hotline: Report threats, impersonation, fraud, scams, doxxing, or conduct that may be criminal. If anyone is in immediate danger, call 911 or go to the nearest police station.

These complaints address abusive conduct; they do not automatically erase a valid loan. A lender may pursue lawful collection, but a debt does not authorize threats, humiliation, or disproportionate use of personal data.

What online lending apps are not allowed to do

The government’s March 2026 joint DICT-NPC-SEC advisory on online lending platforms reiterates that the following practices are prohibited:

Requiring unnecessary phone permissions or processing personal data that is irrelevant or excessive for the stated purpose.
Using contact lists in an unconstrained, excessive, or disproportionate manner.
Processing personal data in a way that leads to harassment or unfair collection.
Contacting people in the borrower’s contact list for debt collection unless they were named—and separately consented to act—as guarantors.
Using threats of violence, other criminal means, or harm to a person’s body, reputation, or property.
Threatening action that cannot legally be taken.
Using a borrower’s photograph to harass or embarrass the borrower.
Retaining personal data longer than necessary for its lawful purpose, legal claims, or a period required by law.

The fact that a borrower clicked “Allow,” accepted terms and conditions, or gave access to a phone does not create unlimited consent. Under the Data Privacy Act of 2012, consent must be freely given, specific, and informed, while all processing must remain transparent, lawful, and proportionate.

Character references are not automatically guarantors

A character reference may be contacted only for identity or information verification. The lender must explain how it obtained the reference’s details and provide an option to have those details removed as a character reference.

A guarantor is different: that person must expressly agree to answer for the borrower’s obligation in case of default. Merely appearing in someone’s contacts—or being named as a reference, relative, coworker, or friend—does not make a person a guarantor. These distinctions are set out in NPC Circular No. 2022-02.

Lawful collection is still permitted

A lender may generally:

Contact the borrower directly and make a truthful payment demand.
Explain the balance and negotiate payment arrangements.
Use data reasonably necessary to administer the loan, comply with law, or establish, exercise, or defend legal claims.
Report credit information when authorized or required by applicable law.
Refer the account to an authorized collection agency or lawyer, subject to privacy and fair-treatment requirements.
File a proper civil action and use lawful court procedures.

A collector may not turn those rights into a license to threaten, deceive, shame, or indiscriminately disclose the debt. The Financial Products and Services Consumer Protection Act expressly prohibits abusive collection or debt-recovery practices and protects consumers’ rights to fair treatment, privacy, and complaint redress.

Act immediately if there is a safety risk

Go directly to law enforcement if a collector:

Threatens physical harm, kidnapping, sexual violence, property damage, or harm to your family.
Publishes or threatens to publish your address, identification documents, intimate material, altered photos, or other information that creates a safety risk.
Impersonates a police officer, prosecutor, judge, lawyer, or court employee.
Sends a fake warrant, summons, criminal charge, or court order.
Demands payment to a suspicious personal account while using threats or coercion.
Takes over an account, uses your identity, or appears to have obtained passwords or one-time PINs.

Do not meet a threatening collector alone. Tell a trusted person what is happening, preserve the messages, and ask the police to assess what criminal complaint or protective action is appropriate.

The Constitution provides that no person may be imprisoned merely for debt. That does not prevent prosecution where separate facts establish another offense, but a private collector cannot lawfully order your arrest or send you to jail. A genuine court notice comes through lawful court processes and should be verified with the named court, not through the collector’s payment link.

Preserve evidence before blocking or uninstalling the app

Create an evidence folder and retain the original files where possible. Save:

Screenshots and screen recordings showing the entire message, profile, phone number, account name, date, and time.
The full URL of every public post, profile, advertisement, or app-store listing.
SMS messages, emails, chat histories, call logs, and voicemails.
Names and numbers used by collectors, including changes in numbers.
Copies of messages sent to family, friends, coworkers, employers, or other contacts.
Written statements or screenshots from people who received the disclosures.
The app’s name, developer, version, privacy notice, requested permissions, and screenshots of its permission settings.
The loan agreement, disclosure statement, repayment schedule, receipts, payment confirmations, and account ledger.
Advertisements or representations about interest, charges, due dates, and collection practices.
The lender’s corporate name, collection agency, website, customer-support details, and SEC registration or Certificate of Authority information.
Your written complaint to the lender or data protection officer, proof of receipt, acknowledgment number, and response.
Proof of harm, such as employer communications, medical or counseling records, expenses, lost income, or takedown requests, where relevant.

Keep an untouched copy in secure storage. Avoid cropping away identifying details. Do not edit or annotate the only copy.

Be cautious about secretly recording live private conversations; the Anti-Wiretapping Act may apply. Preserve existing written messages, call logs, and voicemails, and seek legal advice before making a covert recording.

Secure your phone and accounts

After preserving the evidence:

Revoke the app’s access to contacts, photos, camera, microphone, location, SMS, call logs, and storage unless a permission remains genuinely necessary.
Check whether the app has device-administrator, accessibility, notification-reading, or “install unknown apps” privileges and disable unfamiliar access.
Change passwords for your email, social media, cloud storage, and financial accounts if compromise is suspected. Use unique passwords and enable multifactor authentication.
Review active sessions and sign out unrecognized devices.
Tell affected contacts not to reply, click links, send money, or provide information.
Report impersonating accounts or abusive posts to the platform and save the takedown acknowledgment.
Uninstall the lending app if you no longer need it, but only after preserving its notices, permissions, account records, and identifying information.

Uninstalling the app or revoking phone access does not automatically delete information already obtained by the lender.

Send a written complaint to the lender

Send the complaint through the lender’s official consumer-assistance channel and to its data protection officer if privacy is involved. Use an address shown in the app’s privacy notice, loan documents, official website, or regulator records—not an address supplied only by an anonymous collector.

State:

Your name and account or loan reference, while redacting unnecessary sensitive information.
The app, lender, collection agency, and collector involved.
A dated, factual chronology of what happened.
Which contacts were messaged and what information was disclosed.
Which permissions or personal data were used.
The specific conduct you want stopped.
The action you request, such as stopping contact with non-guarantors, removing a public post, correcting false data, identifying recipients of your data, restricting unlawful processing, or giving you a copy of relevant account and privacy records.
A request that the company preserve collector logs, account notes, call records, access logs, instructions to third-party agencies, and other relevant evidence.
A request for a written response and complaint reference number.

For an eventual NPC complaint, retain proof that the company received this notice. Under the 2021 NPC Rules of Procedure, the general rule is that the affected person must first inform the controller, processor, or concerned entity in writing. The NPC may give a complaint due course when the entity fails to take timely and appropriate action or does not respond within 15 calendar days from receipt.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy from the respondent, or patently illegal conduct. Explain and document those circumstances if immediate NPC intervention is necessary.

File an SEC complaint

The SEC is the primary regulator for lending companies, financing companies, online lending platforms, and their collection agencies.

Online filing

Open the SEC iMessage portal.
Select Open a New Ticket and sign in through eSECURE.
Choose Financing and Lending Companies Department and the service Complaints on Financing and Lending Companies.
Complete the form, upload your complaint and evidence, and retain the electronic ticket number.
Monitor the ticket and respond promptly to requests for clarification or additional documents.

The official iMessage user guide confirms that iMessage is the SEC’s central platform for complaints and allows users to track their tickets.

Prepare one complaint for each respondent company. Include the legal company name if known, the lending app’s name, a valid government-issued ID, loan records, screenshots, messages, contact-list disclosures, receipts, and other supporting documents. If the collector works for a separate agency, identify both the lender and the agency.

The SEC may investigate regulatory violations and impose appropriate administrative sanctions. Its complaint process does not by itself cancel the loan, rewrite payment terms, declare a contract void, or settle the outstanding balance. The SEC’s lending and financing complaint guidance explains these limits.

If the lender appears unregistered or the app is not properly recorded, include that fact. An entity’s unregistered status does not make harassment or misuse of personal data lawful.

File a National Privacy Commission complaint

Use the NPC route where the facts involve:

Access to or copying of contacts beyond what was necessary.
Messaging non-guarantors about the debt.
Public posting of a borrower’s name, photograph, debt, identification, or other personal data.
Use of photos or altered images for shaming.
Inadequate privacy notices or deceptive permission requests.
Refusal to explain the source, use, recipients, or retention of personal data.
Failure to correct, block, remove, or destroy unlawfully processed data where legally warranted.
Continued processing after the purpose ended and no other lawful ground exists.
A personal data breach or inadequate security.

Formal requirements

A data subject may personally file. An authorized representative needs a special power of attorney. Under the current NPC procedure, submit either a completed and notarized complaints-assisted form or a properly verified complaint, together with supporting evidence and witness affidavits, if any.

The complaint should identify the parties, narrate the material facts, state the requested relief, and attach:

Correspondence with the respondent and proof of receipt.
The respondent’s response, if any.
Proof that no response was received within 15 calendar days, where applicable.
Documentary evidence and witness affidavits.
A certification against forum shopping disclosing related cases or complaints.
Authorization documents if a representative is filing.

Related filings with the SEC, police, prosecutor, court, or another body should not be concealed. Describe their subject and current status in the certification where required.

Complaints may be filed personally, by registered mail, by accredited courier, or by electronic mail when authorized by the Commission. Electronic documents must satisfy the NPC’s signing and format requirements. Because filing addresses, authorized email channels, and payment instructions can change, use the current directions and download the official form from the NPC’s File a Complaint page.

An applicable filing fee may be required unless the complainant qualifies for an exemption or the NPC grants a waiver for good cause. The investigating officer generally has 30 calendar days from receipt to give the complaint due course or dismiss it without prejudice; this is an initial evaluation period, not a deadline for final resolution.

Where continued processing risks serious harm, the rules permit an application for a temporary ban on processing. That remedy can require a summary hearing, pleadings, and a bond, so legal assistance is advisable.

Report threats, fraud, or other possible crimes

Regulatory complaints do not replace a police or NBI report when conduct may be criminal.

The March 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; telephone (02) 8723-0401 local 7491

The NBI also provides an online complaint page and a directory of regional and district offices.

A preliminary email or hotline report may not complete a criminal complaint. Investigators may require your personal appearance, sworn statement, identification, device, original electronic evidence, and participation in further proceedings.

Do not delay where defamatory online posts may be involved. In April 2026, the Supreme Court held that cyber libel has a one-year prescriptive period reckoned from discovery by the offended party, the authorities, or their agents. Whether a particular collection message or post satisfies all elements of that offense is fact-dependent, and other possible offenses have different periods. See the Supreme Court’s decision and summary in Causing v. People, G.R. No. 258524.

Which office should receive the complaint?

Main issue	Primary channel
Abusive collection by a lending or financing company or its collector	SEC iMessage
Unauthorized access, disclosure, contact-list use, photo misuse, or excessive retention	National Privacy Commission
Threats, fraud, impersonation, account compromise, or potentially criminal conduct	PNP, NBI, DICT Cyber Hotline, or the local police
Complaint against a bank, digital bank, e-wallet provider, or other BSP-supervised institution	First complain through the institution’s consumer-assistance mechanism; if unresolved, use the BSP Consumer Assistance Mechanism
Immediate danger	911 or the nearest police station

More than one route may be appropriate because the agencies address different issues. Keep the facts consistent and disclose related proceedings when a form or certification requires it.

Common mistakes to avoid

Deleting the app, messages, or posts before making complete copies.
Submitting cropped screenshots that omit the sender, date, time, URL, or surrounding conversation.
Naming only the app and not identifying the corporate lender or collection agency.
Filing vague accusations without a dated chronology or supporting documents.
Filing an NPC complaint without first sending written notice to the respondent, unless a waiver is requested and justified.
Treating a reference as a guarantor without proof of the person’s separate consent.
Paying through a collector’s personal account without verifying the lender’s official payment channel.
Sharing passwords, PINs, one-time passwords, full card numbers, or unnecessary identification documents with a collector.
Assuming that a regulator’s complaint automatically suspends, settles, or cancels the loan.
Ignoring a genuine summons or court notice because earlier collector messages were fake. Verify the court and case details independently.
Secretly recording private calls without first checking the legal implications.
Posting your own unredacted loan documents or IDs publicly while asking for help.

When to obtain legal help urgently

Consult a Philippine lawyer, the Public Attorney’s Office if eligible, or an appropriate legal-aid organization promptly when:

Physical violence, sexual threats, blackmail, or intimate-image abuse is involved.
A collector has published your address, ID, family details, or altered photographs.
You receive an apparently genuine subpoena, summons, prosecutor’s notice, warrant, or court pleading.
The lender disputes your identity or claims you obtained a loan you never applied for.
Money was taken without authorization or an account was compromised.
You need an urgent NPC temporary ban, injunction, damages claim, or takedown order.
You are considering a criminal complaint with a short prescriptive period.
Several lenders, collectors, or affected relatives are involved and the evidence must be coordinated.
Your employment, housing, physical safety, or mental health is being seriously affected.

Frequently asked questions

Can a lender message everyone in my contacts because I accepted the app’s terms?

No. Consent is not a blanket authorization for excessive processing or harassment. Contact-list processing must remain suitable, necessary, and proportionate. For debt collection, the current NPC rules prohibit contacting people in the borrower’s contact list other than persons who expressly consented to be guarantors.

Can the app contact my character reference about payment?

A character reference is for identity and information verification and is not automatically a guarantor. For that person to be treated as a guarantor, separate and express consent consistent with the rules on guaranty is required.

Can family members, coworkers, or my employer be told about the debt?

Using third parties to shame or pressure a borrower, or disclosing the debt to non-guarantors from the borrower’s contacts, is prohibited. A legally required disclosure or formal court process is different and must be evaluated under the law and the specific documents.

I am not the borrower. Can I complain about messages sent to me?

Yes. If your own name, number, messages, or other personal data were improperly processed, you may assert your rights as a data subject and file an NPC complaint. Tell the lender in writing that you are not a guarantor, ask how it obtained your information, request that collection contact stop, and preserve its response.

Does withdrawing consent require the lender to delete everything immediately?

Not necessarily. You may seek blocking, removal, or destruction of data that was unlawfully obtained, used for unauthorized purposes, or is no longer necessary. The lender may retain information that remains necessary to perform the contract, meet a legal obligation, or establish, exercise, or defend legal claims. It must still stop processing that lacks a lawful and proportionate basis.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers, but keep at least one safe written channel open for legitimate account notices if practical. Request that future communications be made in writing through the lender’s official channel.

What if the loan is genuinely overdue?

An overdue balance does not legalize harassment. Continue to separate the two issues: dispute or negotiate the balance in writing, and report abusive collection independently. Pay only through verified official channels and keep receipts.

Will filing a complaint cancel my loan?

No. SEC, NPC, and law-enforcement complaints concern regulatory, privacy, or possible criminal violations. The underlying debt depends on the contract, payment history, applicable law, and any valid defenses. Only an authorized settlement, adjudication, or court ruling can determine the parties’ financial obligations.

Is an unregistered or unrecorded lending app outside Philippine privacy rules?

No. Unregistered status does not excuse unlawful personal-data processing or harassment. Report the entity, app, developer, phone numbers, payment accounts, and advertisements even if its exact corporate identity is uncertain.

Official legal and procedural sources

This article provides general legal information, not advice for a particular case. The correct remedy may depend on the lender’s regulatory status, the loan documents, the exact communications, the data used, and the available evidence. Official sources and procedures were checked as of 18 August 2026.