If you've taken a loan from an online lending app and your family, friends, coworkers, or even distant contacts suddenly start receiving calls, texts, or messages about your debt, you are experiencing a common but illegal practice. Lending apps or their collectors often harvest phone contacts during the loan application and then use that information to pressure repayment through embarrassment, repeated contact, or shaming. This is not legitimate debt collection. Philippine law treats it as a violation of your data privacy rights and as an unfair collection practice. You can fight back by filing complaints with the National Privacy Commission (NPC) for privacy breaches or the Securities and Exchange Commission (SEC) for unfair debt collection by lending companies. This article explains your rights, the exact steps to file effective complaints, what evidence works best, and what to expect in practice.

What Counts as Contact Harassment by Lending Apps

Lending apps typically require broad phone permissions during signup for “verification” or “credit scoring.” Once installed, they can access your entire contact list, call logs, photos, or even social media data. Collectors then call or message people in your contacts, reveal that you have an unpaid loan, ask them to pay on your behalf, or use threatening or humiliating language.

Common tactics include:

Calling at odd hours (late at night or early morning)
Using abusive, profane, or threatening language
Claiming your contacts are “co-makers” or “references” when they are not
Repeatedly contacting the same people even after being told to stop
Disclosing the exact loan amount, due date, or your personal situation

These actions violate core legal protections. They cause real harm — emotional distress, damaged relationships, workplace issues, and reputational damage — especially for overseas Filipino workers whose families back home get targeted.

Your Legal Rights and Protections

Data Privacy Act of 2012 (Republic Act No. 10173)

The Data Privacy Act requires that any processing of personal data (names, phone numbers, relationship details, debt information) must have a valid legal basis, be limited to what is necessary, and respect the rights of data subjects. Harvesting contacts and disclosing your debt to third parties without their informed consent — and often without a legitimate purpose beyond aggressive collection — is unauthorized processing.

The National Privacy Commission reinforced this in its Circular No. 20-01 (2020), which explicitly prohibits online lenders from harvesting phone or social media contact lists for debt collection or harassment. Lenders must follow “privacy by design,” limit app permissions, and securely dispose of unnecessary data. Violations can lead to investigations, fines up to several million pesos, orders to delete data, and even criminal referral.

SEC Memorandum Circular No. 18, Series of 2019

All SEC-registered financing and lending companies are prohibited from unfair debt collection practices. Key banned acts relevant to contact harassment include:

Using threats, violence, or criminal means against a person’s reputation or property
Disclosing or publishing a borrower’s debt information to third parties (except in very limited cases involving named guarantors or co-makers)
Contacting people in the borrower’s contact list who are not named guarantors or co-makers in the loan agreement — this alone constitutes an unfair practice
Using insults, obscenities, or profane language
Making repeated or unreasonable contacts, including at unreasonable hours (commonly understood as before 6:00 a.m. or after 10:00 p.m.)
Communicating false information about the debt or threatening actions that cannot legally be taken

The SEC has revoked or suspended licenses and imposed fines on companies for exactly these behaviors. A March 18, 2026 joint advisory from DICT, NPC, and SEC reiterated these rules for all online lending platforms, emphasizing data minimization, valid consent, and fair treatment. It explicitly discourages accessing contact lists or contacting non-guarantors.

You have the right to stop this. Filing complaints triggers official investigations that can force companies to cease the practices, delete improperly obtained data, and face real penalties.

Which Agency Should You Complain To — NPC, SEC, or Both?

File with the NPC when the core issue is unauthorized access to and use of your personal data and contacts (privacy violation). This is often the strongest and most direct route for contact harvesting cases.

File with the SEC when the lender is (or claims to be) a registered lending or financing company and the issue involves unfair collection tactics. The SEC can issue cease-and-desist orders, fines, and revoke the company’s authority to operate.

Many borrowers file with both agencies because the same facts violate both frameworks. The agencies may coordinate or act independently. If the app or company appears unregistered or operating illegally, prioritize the SEC’s Enforcement and Investor Protection Department alongside the NPC.

Practical Step-by-Step Guide: Preparing and Filing Your Complaint

1. Gather Strong Evidence (Do This First)

Strong documentation wins cases. Collect:

Screenshots of every harassing message or call log (include date, time, phone number, and content). Ask affected contacts to screenshot and forward everything to you.
Screenshots showing the app requested or accessed contacts (phone permission screens, app settings).
Copies of the loan agreement, repayment schedule, any payment confirmations or disputes, and all your prior communications with the lender.
Proof of the company behind the app (Play Store developer name, website, any SEC registration number shown in the app or terms).
Your formal demand letter (see below) and proof it was sent (email read receipts or registered mail receipt).
Any recordings or detailed notes of calls (Philippine law generally allows one-party consent recording for personal use, but focus on written evidence).

Organize everything chronologically in folders. The clearer and more specific your evidence, the faster and stronger the agency response.

2. Send a Formal Demand Letter First (Strongly Recommended)

Before or while preparing your official complaint, send a written demand to the company’s Data Protection Officer (DPO) and customer service.

State clearly:

You are exercising your rights under the Data Privacy Act.
Demand they immediately stop contacting any third parties about your loan.
Demand they delete any harvested contact data and confirm this in writing within 5–7 days.
Demand they cease all harassing communications.
Warn that you will file complaints with the NPC and SEC if they do not comply.

Send via email (with read receipt) and/or registered mail. Keep copies and proof of delivery. Many companies back down or at least reduce activity after a proper demand. This step also shows agencies you tried to resolve it directly.

3. Filing with the National Privacy Commission (NPC)

Download the current Complaint-Affidavit form from the NPC website (privacy.gov.ph). Fill it out completely and accurately. Describe the facts in clear, chronological order: how the app obtained access to contacts, how that data was used to contact third parties, what was said or disclosed, and the impact on you and your contacts. Identify the respondent company as precisely as possible and attach all your evidence.

Have the completed affidavit notarized by any notary public (bring valid ID). Pay the filing fee of ₱500 (plus a small legal research fee; indigent litigants can apply for exemption with a barangay certificate of indigency and supporting affidavit).

Submit options:

Email scanned copies to complaints@privacy.gov.ph (most convenient for many)
Courier or in-person delivery to the NPC office (currently at the 5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City — confirm current address on their site)
Any online complaint system available on privacy.gov.ph

The NPC will review, may request more information, and can mediate, investigate, issue orders to stop processing or delete data, impose fines, or refer the matter for criminal prosecution under the Data Privacy Act.

4. Filing with the Securities and Exchange Commission (SEC)

Use the SEC i-Message portal at imessage.sec.gov.ph — this is the primary and most accessible channel for complaints, including unfair debt collection. You can also email the relevant division (Financing and Lending Companies Division or Enforcement and Investor Protection Department) using contacts listed on sec.gov.ph.

In your complaint, clearly state that you are reporting unfair debt collection practices involving contact harassment in violation of SEC Memorandum Circular No. 18, Series of 2019. Provide the same strong evidence package. Identify whether the company appears registered and include any SEC registration details if known. For unregistered or illegal operations, the Enforcement department handles those cases as well.

The SEC can investigate, order the company to stop the specific practices, impose administrative fines, suspend or revoke the Certificate of Authority to operate as a lending company, and take other enforcement actions. The March 2026 joint advisory encourages the public to report these exact abuses through this channel.

What Happens After You File

Agencies typically acknowledge receipt within days. They review the complaint, notify the company, and give it an opportunity to respond. Many cases involve mediation or result in the company being ordered to stop contacting third parties and delete data.

Serious or repeated violations lead to fines, business restrictions, or license revocation. Timelines vary — straightforward cases can see movement in weeks to a couple of months; more complex ones take longer. You can follow up using your case reference number. Supplement the complaint with any new incidents that occur after filing.

Outcomes are not guaranteed to include monetary compensation to you (that may require a separate civil case), but stopping the harassment and holding the company accountable is the primary and most achievable goal. Regulatory actions create public records that help protect other borrowers.

Common Challenges and How to Handle Them

Identifying the exact company behind a generic-sounding app name can be tricky. Search the app details, terms of service, website, and SEC company databases. Many use multiple brands or third-party collectors — include all of them in your complaint.

Some companies ignore demands or switch numbers. Keep documenting everything and submit updates to your complaint.

For overseas Filipino workers or foreigners: The process works the same through email and courier. Enforcement focuses on the company’s Philippine registration and operations. Results may take longer across time zones, but successful complaints still lead to regulatory sanctions that affect the business.

If threats of physical harm, serious libel, or other criminal acts are involved, file a separate report with the PNP Anti-Cybercrime Group or NBI Cybercrime Division in addition to NPC/SEC complaints.

Frequently Asked Questions

Can lending apps legally access and use my phone contacts?
No. NPC Circular No. 20-01 and the Data Privacy Act prohibit harvesting contact lists for debt collection or harassment. Broad app permissions do not give them ongoing permission to contact or disclose information to your family and friends.

What if the loan agreement or app terms mention “references” or I granted permissions?
Consent must be specific, informed, and freely given for the exact purpose. Naming someone as a reference does not authorize aggressive collection or shaming. SEC rules explicitly prohibit contacting people in your contact list who are not named guarantors or co-makers.

Is it worth complaining if I still owe money?
Yes. Illegal collection methods are wrong regardless of the debt. You can address the loan balance separately through negotiation or other legal channels while stopping the harassment.

How much does filing cost?
NPC complaints have a ₱500 filing fee (plus minor legal research fee; exemptions available). SEC i-Message complaints are generally free or very low cost.

Will the company retaliate or know I complained?
They will be notified during the investigation, but retaliation is itself illegal and can strengthen your case. Agencies handle many complaints and protect complainants.

Can I remain anonymous?
NPC accepts complaints that allow for initial assessment even if not fully identified in some cases, but providing your details helps with follow-up and mediation. SEC complaints are typically identified.

What if the harassment continues after I file?
Document every new incident with fresh evidence and submit it as a supplement to your existing complaint. This shows ongoing violation and can accelerate action.

Should I also report to other agencies?
For criminal elements (threats, cyber libel), yes — contact PNP or NBI cyber units. Barangay mediation or DTI consumer complaints can be additional avenues, but NPC and SEC are the primary specialized agencies for these issues.

How long until the harassment stops?
Some companies reduce or stop activity after a strong demand letter or initial agency contact. Full resolution through investigation and orders usually takes weeks to several months. Continue documenting until it fully stops.

Key Takeaways

Contacting your personal network to harass or shame you about a debt violates the Data Privacy Act and SEC rules on unfair collection practices.
File with the NPC for privacy violations and the SEC for unfair debt collection — doing both often provides the strongest protection.
Strong, organized evidence (especially screenshots of third-party contacts and disclosures) combined with a prior written demand letter makes your complaint far more effective.
The process is accessible through email and online portals, with modest fees at the NPC and clear procedures at both agencies.
Government regulators continue to act on these widespread complaints, as shown by enforcement actions, license revocations, and the March 2026 joint DICT-NPC-SEC advisory.
Taking these steps protects you and helps curb abusive practices that affect thousands of borrowers.

You have clear legal rights and practical avenues to stop this. Start with documentation and a demand letter today, then file with the appropriate agency or agencies. The sooner you act with proper evidence, the sooner the pressure can shift from you and your contacts back to the company where it belongs.