Quick answer

If an online lending app threatens you, publicly shames you, misuses your photos, or contacts people in your phone for debt collection, preserve the evidence and report the conduct to the proper agency:

Unfair or abusive collection by a lending or financing company: file with the Securities and Exchange Commission (SEC) through the SEC iMessage portal.
Unauthorized access, disclosure, or excessive use of personal data: complain first in writing to the lender or app operator. If it does not take timely and appropriate action—or does not respond within 15 calendar days from receipt—file a formal complaint with the National Privacy Commission (NPC). The NPC may waive this prior-notice requirement for good cause or a serious violation involving a substantial risk of harm.
Threats, extortion, impersonation, fraud, or immediate danger: report promptly to law enforcement. Call 911 if anyone is in immediate physical danger.
A loan app operated by a bank or another BSP-supervised institution: use the institution’s complaint channel first, then escalate an unresolved complaint through the BSP Consumer Assistance Mechanism.

A complaint does not automatically cancel a valid loan, stop lawful collection, or erase legitimate records. Harassment and privacy violations can still be reported even when the debt is real or overdue.

What collectors are not allowed to do

Creditors may make lawful efforts to collect a debt, contact the borrower at reasonable times, send accurate payment demands, negotiate repayment, and pursue a proper civil action. They may not use abusive collection practices or process personal data without a lawful, proportionate purpose.

Under the Financial Products and Services Consumer Protection Act, financial service providers must treat consumers fairly, protect client data, maintain a free complaint mechanism, and refrain from abusive collection or debt-recovery practices. A provider may also be responsible for acts of its employees, agents, or covered third-party collection providers.

The SEC’s Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by SEC-regulated lending and financing companies. Potential violations include:

Threatening violence or other criminal means against a person, reputation, or property;
Threatening an action that cannot legally be taken;
Using abusive, obscene, insulting, or profane language in circumstances covered by the rule;
Publicly shaming a borrower or disclosing loan information to unauthorized persons;
Using false representations or deceptive collection tactics;
Giving or threatening to give false credit information; and
Communicating at unreasonable or inconvenient hours, subject to the circular’s qualifications.

The exact context matters. A firm but accurate payment reminder is not automatically harassment. Repeated threats, humiliation, false claims, unauthorized disclosures, or use of third parties to pressure the borrower are materially different.

Privacy rules specifically applicable to lending apps

The Data Privacy Act of 2012 requires personal-data processing to be transparent, lawful, for a legitimate purpose, and proportionate. Data must not be excessive and generally may be retained only as long as necessary for its stated purpose, legitimate business needs, legal claims, or a legal requirement.

For loan-related processing, NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, establishes more specific protections:

Lending apps must not demand unnecessary permissions or process more data than is suitable and necessary.
Camera or photo-gallery access may be used for a legitimate step such as identity verification or payment verification, but access should end when that purpose has been completed.
A borrower’s photo must never be used to harass or embarrass the borrower into paying.
Unconstrained, excessive, or disproportionate processing of a contact list is prohibited.
Contact-list processing that leads to harassment, unfair collection, or collection from persons other than the borrower’s guarantors is prohibited.
An app may provide a limited interface allowing the borrower to select a character reference or guarantor. This does not permit the app to copy and contact everyone in the phone.
A character reference may be contacted to verify the borrower’s identity or the truth of information supplied in the application. A character reference is not automatically a guarantor and must not be contacted for debt collection.
A guarantor must have separately and expressly agreed to act as guarantor. For collection purposes, the lender may contact that guarantor, subject to applicable law.
Character references must be told that they were named, how their details were obtained, and how they can request removal as a reference.

These rules were reaffirmed in the government’s 18 March 2026 joint advisory on online lending platforms.

“But I allowed access to my contacts”

Granting a phone permission does not give an app unlimited authority to copy, disclose, or use every contact for collection. Consent must be freely given, specific, and informed. Excessive processing remains prohibited, and deceptive interface designs may undermine the validity of consent.

A privacy notice also cannot lawfully waive a financial consumer’s statutory rights. However, withdrawing consent does not always require the lender to delete every record immediately: some processing may remain lawful because it is necessary to perform the loan contract, comply with law, report authorized credit information, or establish or defend a legal claim.

What to do immediately

1. Address any safety risk first

If a collector threatens imminent violence, says someone is coming to harm you, publishes your home location, or creates another immediate danger:

Call 911 or go to the nearest police station.
Tell a trusted person where you are.
Do not meet a collector alone.
Preserve the exact threat, account name, phone number, date, time, and any identifying details.

For cyber-related threats, fraud, or intimidation, the 2026 joint advisory identifies these official reporting channels:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
DICT Cyber Hotline: 1326@dict.gov.ph

The BSP’s current consumer guidance also lists the Cybercrime Investigation and Coordinating Center’s hotline 1326 and report@cicc.gov.ph.

2. Preserve evidence before blocking or uninstalling the app

Save:

Full, uncropped screenshots of texts, chats, emails, social-media posts, and app notifications;
The sender’s number, account URL, profile name, and profile image;
Call logs showing dates, times, and frequency;
Voicemails already left for you;
Screenshots of messages sent to relatives, coworkers, employers, or other contacts;
The app’s store page, developer name, app version, privacy notice, permission requests, and displayed legal company name;
Screenshots of the permissions currently enabled;
Loan agreement, disclosure statement, promissory note, repayment schedule, statement of account, receipts, and payment instructions;
The amount actually received, amounts paid, charges imposed, and amount being demanded;
Any fake-looking summons, warrant, demand letter, police notice, or lawyer’s letter;
Your written complaint to the company and proof that it was received; and
Ticket numbers, acknowledgment emails, and agency replies.

Ask contacted relatives or coworkers to keep their original messages and write a dated account of what happened. An affidavit may later be useful.

Keep the original files and at least one backup. Avoid editing the originals. Do not secretly record private calls without legal advice: the Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Written messages, call logs, permitted recordings, and voicemails can be preserved without creating that risk.

3. Secure your accounts and device

After preserving the evidence:

Revoke the app’s access to contacts, camera, photos, microphone, location, SMS, and other unnecessary resources.
Change passwords for email, social media, cloud storage, and financial accounts if the app may have accessed them.
Enable multifactor authentication.
Review active sessions and sign out unfamiliar devices.
Warn affected contacts not to click links, send money, disclose personal information, or respond to threats.
Remove the app after documenting it if you no longer need it for legitimate account access. Revoking permissions or uninstalling does not by itself delete data already copied by the operator.

4. Identify the correct respondent

The app’s brand may differ from the legal company that granted the loan. Record:

App and website name;
Developer or publisher;
Lending or financing company’s full legal name;
SEC registration and Certificate of Authority details, if displayed;
Collection agency’s name;
Payment-account holder;
Customer-service and data-protection contact details; and
Names or aliases used by individual collectors.

Search the SEC’s official lists or use the link to “Check with SEC” available on the SEC iMessage portal. If you cannot identify the company, give regulators every available clue instead of guessing.

Send a written demand to the company

For a privacy complaint, written notice to the company is normally required before the NPC will give the case due course. Send the notice to the lender’s customer-assistance unit and, if available, its Data Protection Officer. Use a channel that produces proof of delivery.

State:

Your name and account or loan reference, without placing unnecessary sensitive information in the email subject;
The specific acts complained of, with dates and numbers used;
Which people were contacted and what was disclosed;
Which device permissions or personal data were allegedly misused;
That you demand an immediate stop to harassment, public disclosure, and unauthorized contact-list processing;
That future lawful communications should be sent only through a specified channel;
A request to identify the source, purpose, method, recipients, retention period, and legal basis for processing your data;
A request to correct, block, remove, or destroy unlawfully obtained, unauthorized, inaccurate, or no-longer-necessary data, subject to lawful retention requirements;
A request that the company preserve collection logs and other relevant records; and
The remedy you want, such as removal of posts, cessation of third-party contact, correction of records, investigation of the collector, or a written response.

Keep proof of receipt. The NPC’s 15-calendar-day period runs from the respondent’s receipt of the written notice—not merely from the date you drafted it.

How to report unfair collection to the SEC

The SEC regulates ordinary lending companies, financing companies, their online lending platforms, and collection conduct within its jurisdiction.

Go to the SEC iMessage portal and open a new ticket. Sign in or create the required eSECURE account if prompted.
Select the service or department for financing and lending companies or FINLEND.
Identify the legal company and the app. If the collector is separate, identify both.
Give a chronological account: loan date, due date, first abusive contact, each threat or disclosure, people contacted, and continuing conduct.
Upload the loan documents, valid identification requested by the portal, screenshots, call logs, payment records, and correspondence.
State the relief requested, such as investigation, an order to stop unfair collection, or referral to another agency.
Save the ticket number and monitor the portal and your email for requests for additional documents.

The SEC’s published complaint guidance stresses complete forms, supporting evidence, a valid government-issued ID, and one complaint per respondent company. Its current March 2026 advisory directs online-lending complaints to iMessage.

The SEC may investigate and impose regulatory sanctions when supported by the evidence. It may also refer privacy, criminal, or other issues to the appropriate agency. An SEC complaint by itself does not change payment terms, cancel the loan, declare the contract void, or settle the balance.

How to file a privacy complaint with the NPC

Step 1: Complete the 15-day prior-notice requirement

Normally, you must prove both that:

You informed the lender, app operator, collection provider, or other responsible entity in writing about the privacy violation or personal-data breach; and
It failed to take timely and appropriate action or did not respond within 15 calendar days from receipt.

Under the 2021 NPC Rules of Procedure, the NPC may waive this requirement at its discretion when good cause is properly alleged and proved or when the complaint involves a serious violation and significant risk of harm. Examples in the rule include grave and irreparable damage requiring NPC intervention, absence of a plain and adequate remedy from the respondent, or patently illegal conduct. Explain and document the urgency; do not simply assume that a waiver applies.

Step 2: Prepare the formal complaint

Use the current NPC Complaint-Assisted Form and filing instructions. The form must be completed and notarized, or the complaint must otherwise be verified under oath.

Include:

Your identity and contact details;
The respondent’s legal identity and service details, if known;
A clear factual narrative;
The particular data processed or disclosed;
The acts or omissions alleged to violate the Data Privacy Act or NPC rules;
The relief requested;
Copies of all correspondence with the respondent;
Proof of the respondent’s receipt and its reply, if any;
Documentary evidence and witness affidavits, when available; and
A certification against forum shopping.

If another case involving the same issues is already pending, disclose its status. Under the NPC rules, a complainant who later learns that the same or a similar case has been filed must report that fact to the NPC within five calendar days.

Step 3: File and pay the applicable fee

A formal complaint may be filed personally, by registered mail, by accredited courier, or by electronic mail as authorized by the NPC. The current filing page instructs complainants to print and complete the form, have it notarized, then submit it personally, by courier, or as a scanned email attachment. Check the NPC contact page immediately before filing for the current address, complaint email, and telephone numbers.

For personal filing, the procedural rules call for two original copies plus as many copies as there are receiving parties. Electronic submissions should comply with the NPC’s PDF and signature requirements.

Under NPC Circular No. 2023-01, the base complaint filing fee is ₱500, plus the applicable legal research fee and any additional fee for a claim of damages. Indigent complainants may qualify for an exemption if they meet the circular’s income and property conditions and submit the required barangay certificate, affidavits, and supporting documents. Confirm the assessment and payment instructions with the NPC before sending money.

A complaint can be dismissed without prejudice if it is defective in form, lacks evidence, fails to show prior written notice without a justified exception, does not allege a privacy issue, or does not sufficiently identify or trace the parties. Follow requests to correct deficiencies promptly.

If the lender is BSP-supervised

Ordinary online lending and financing companies should generally be reported to the SEC. If the app or loan is provided by a bank, digital bank, e-wallet operator, or another BSP-supervised institution:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel.
Keep the complaint reference and the institution’s response.
If unresolved or unsatisfactory, escalate through the BSP Online Buddy, accessible from the BSP website, or submit the BSP Complaint/Inquiry/Reply form to consumeraffairs@bsp.gov.ph.
Attach proof that you first complained to the institution and copies of the supporting documents.

The BSP consumer-assistance page contains the current form, channels, and office information.

When legal help is urgent

Consult a lawyer promptly—or approach the Public Attorney’s Office if you may qualify for assistance—when:

Threats suggest imminent violence or physical surveillance;
Private photos, IDs, address details, or intimate information have been published;
The company continues contacting numerous people after written notice;
Someone is impersonating a police officer, court, lawyer, or government agency;
You receive a genuine court summons, subpoena, prosecutor’s notice, or warrant;
Money was taken through an unauthorized transaction;
The alleged lender cannot be identified or appears unlicensed;
You are being asked to sign a waiver, admission, settlement, or new promissory note you do not understand;
You want damages, emergency injunctive relief, or coordinated civil and criminal action; or
A filing deadline may be approaching.

Do not ignore genuine court papers. Verify them directly with the court or agency using independently obtained official contact details—not the phone number supplied by the collector.

The Constitution provides that no person may be imprisoned merely for debt. That does not prevent a creditor from filing a lawful civil case, and separate conduct such as alleged fraud may raise different issues. A threat of “automatic arrest” based only on nonpayment should be documented and independently verified.

Common mistakes to avoid

Uninstalling the app or deleting chats before preserving evidence;
Submitting cropped screenshots that omit the sender, date, time, or surrounding conversation;
Naming only the app brand and not the actual lender or collection agency;
Filing with the NPC without first sending written notice or explaining and proving why a waiver is warranted;
Treating a character reference as if that person had agreed to guarantee the loan;
Posting unredacted IDs, contracts, phone numbers, or third-party messages publicly;
Secretly recording private calls without considering the Anti-Wiretapping Act;
Paying an individual collector’s personal account without verifying the official payment channel and obtaining a receipt;
Assuming harassment makes the debt disappear;
Ignoring legitimate payment notices or court documents because abusive messages were also received; and
Waiting until accounts, posts, or phone records have disappeared.

Frequently asked questions

Can I report the app even if I really owe money?

Yes. A valid debt does not authorize threats, humiliation, false statements, excessive contact-list use, or unauthorized disclosure. Address the balance and the abusive conduct as separate issues.

Can a lending app message everyone in my contacts?

No. Current NPC rules prohibit unbridled contact-list processing and prohibit contacting people in the borrower’s contact list for debt collection unless they were validly named and consented as guarantors. Limited contact with a chosen character reference may be allowed for identity or information verification, not collection.

Is a character reference responsible for my loan?

Not merely because the person was listed as a reference. A guarantor must expressly agree to undertake the obligation in accordance with applicable law. A reference must not automatically be treated as a guarantor.

Can I demand deletion of all my information?

You may seek blocking, removal, or destruction of data that was unlawfully obtained, used without authority, inaccurate, or no longer necessary. The lender may still retain information necessary for the contract, regulatory compliance, authorized credit reporting, or legal claims. Ask it to identify the lawful basis and retention period for anything it refuses to remove.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers and require lawful communications through one written channel. Blocking a number does not resolve the loan or prevent a creditor from using proper legal processes.

Can I file with the SEC and NPC at the same time?

Yes, when the facts involve both unfair collection and misuse of personal data. Explain any related filings in each complaint and comply with the NPC’s certification-against-forum-shopping requirements. A police or cybercrime report may also be appropriate for separate threats, fraud, or other suspected crimes.

Will reporting automatically stop collection?

Not necessarily. A regulator may investigate, require a response, facilitate resolution, or impose appropriate orders and sanctions. Continue documenting new incidents. If serious harm is ongoing, clearly state the urgency and obtain legal advice about available interim relief.

Is there a deadline?

File promptly while evidence and account records remain available. The NPC requires the usual 15-calendar-day opportunity for the respondent to act before formal filing, unless the NPC grants a waiver. Limitation periods differ according to the statute and remedy. Republic Act No. 11765 generally provides a five-year period for actions or claims under that Act from the financial transaction or discovery of deceit or material nondisclosure, with a ten-year outside limit, but this does not determine the deadline for every privacy, criminal, civil, or regulatory claim.

Official sources

This article provides general legal information, not advice for a particular case. Outcomes and available remedies depend on the messages, contract, identities of the parties, consent records, app permissions, and other evidence. Official sources and procedures were checked as of 18 August 2026.