Quick answer

Online lenders may demand payment of a lawful debt, but they may not threaten, shame, deceive, insult, publicly expose, or unlawfully use personal data to pressure a borrower. An unpaid loan does not give a lender permission to contact everyone in the borrower’s phone, post the borrower’s photograph, fabricate criminal charges, or disclose the debt to unrelated persons.

Report the conduct to the agency that regulates the lender and the particular violation:

Securities and Exchange Commission (SEC): harassment or unfair collection by lending and financing companies.
National Privacy Commission (NPC): unauthorized access, collection, use, retention, or disclosure of personal data.
Bangko Sentral ng Pilipinas (BSP): complaints against banks, digital banks, e-wallet issuers, and other BSP-supervised financial institutions.
Police or National Bureau of Investigation (NBI): threats, extortion, impersonation, stalking, account compromise, or other potentially criminal conduct.

These remedies may be pursued separately when the same acts violate more than one law. Filing a complaint, however, does not automatically erase a valid loan or suspend lawful collection.

What online lenders are prohibited from doing

Under SEC Memorandum Circular No. 18, Series of 2019, financing and lending companies—and the collection agencies, representatives, and service providers acting for them—must observe fair collection practices.

Potentially prohibited conduct includes:

using threats of violence, harm, arrest, prosecution, or another action that the collector cannot lawfully take;
using obscenities, insults, degrading language, or abusive statements;
falsely claiming to be a lawyer, police officer, court employee, government representative, or another person with official authority;
falsely representing that a criminal case, warrant, court order, or government proceeding already exists;
threatening to publish, or actually publishing, a borrower’s name, photograph, personal information, or supposed debt merely to shame the borrower;
communicating debt information to people who are not legally or contractually concerned with the obligation;
contacting people in the borrower’s phone or social-media network who were not voluntarily identified as guarantors, co-makers, or character references;
repeatedly contacting the borrower at unreasonable hours or in an oppressive manner; and
using deceptive means to collect or obtain information about the borrower.

A collector may ordinarily contact the borrower and, when legally relevant, an identified guarantor, co-maker, or character reference. That does not authorize mass messaging, public shaming, or disclosure to relatives, neighbors, co-workers, clients, or social-media contacts who have no proper connection to the loan.

A lender remains accountable for collectors and third-party service providers processing personal data on its behalf. It cannot automatically avoid responsibility by saying that the harassment came from an outsourced collection agency.

When the conduct is also a privacy violation

The Data Privacy Act of 2012 requires personal information to be processed for a lawful, declared, and specific purpose and only to the extent necessary and proportionate to that purpose.

More specifically, NPC Circular No. 2020-01 governs personal-data processing in loan-related transactions. It applies to lending and financing companies, persons acting as lenders even without the required SEC authority, and their third-party processors.

The circular provides, among other rules, that:

a lending app must not require unnecessary or excessive phone permissions;
access to a camera or gallery for identity verification must not become continuing authority to use a borrower’s photographs;
a borrower’s photograph must never be used to harass or embarrass the borrower in collecting a debt;
harvesting, copying, or saving phone contacts, email contacts, or social-media contacts for collection or harassment is prohibited;
an app should use a separate interface through which the borrower personally supplies chosen character references or co-makers;
collected information must not be kept indefinitely without a lawful and defined purpose; and
the lender remains accountable for personal information handled by its collection agency or other service provider.

Privacy violations may therefore exist even when the borrower actually owes money. Consent to process information for evaluating and administering a loan is not unlimited consent to shame the borrower, contact an entire address book, or disclose the debt publicly.

People whose contact details were harvested or who received messages about another person’s debt may also be data subjects with their own privacy rights. They do not have to be the borrower to complain about the misuse of their personal information.

Which agency should receive the complaint

Situation	Proper initial route
A lending or financing company uses threats, insults, public shaming, deceptive collection, or unauthorized third-party contact	SEC
The app accessed contacts, photographs, messages, location, or other data unnecessarily, or disclosed personal information without lawful basis	NPC
The provider is a bank, digital bank, e-wallet issuer, credit-card issuer, or another BSP-supervised institution	Provider’s consumer-assistance unit first, then BSP
The messages contain credible threats, extortion, impersonation, account hacking, or immediate danger	PNP or NBI; contact emergency services when necessary
Several kinds of misconduct occurred	File with each agency having jurisdiction; disclose related proceedings when a form or certification requires it

Identify the actual company behind the app, not only the app’s marketing name. Examine the loan agreement, disclosure statement, privacy notice, payment instructions, app-store developer information, text messages, email domain, and SEC registration details.

A certificate of corporate registration alone does not necessarily authorize a company to operate as a lending or financing company. Such a company ordinarily needs the appropriate SEC authority for that business.

What to do immediately

1. Preserve the evidence before blocking or uninstalling the app

Save:

complete screenshots of threats, insults, posts, and collection messages;
screen recordings showing the sender’s profile, number, message thread, date, and time;
call logs and, where lawfully available, voicemail recordings;
URLs and screenshots of public posts, comments, group chats, or altered photographs;
the app’s exact name, developer, download page, version, and privacy policy;
screenshots of the permissions requested or granted to the app;
the loan agreement, promissory note, disclosure statement, repayment schedule, and receipts;
proof of the amount actually received and every payment made;
names and statements of relatives, co-workers, or other persons contacted;
messages showing that the collector knew the debt belonged to someone else;
your written complaint to the lender and proof that it was received; and
the collector’s claimed company, employee name, agency, account number, payment channel, and telephone numbers.

Keep the original electronic files. Do not rely solely on cropped screenshots. Back up the evidence to another device or secure storage, and prepare a chronological list of incidents.

2. Secure the phone and online accounts

After preserving evidence:

revoke unnecessary permissions for contacts, storage, photos, camera, microphone, and location;
review which apps have accessibility, device-administrator, notification, or overlay access;
change passwords for email, banking, e-wallet, and social-media accounts;
enable multi-factor authentication;
warn affected contacts that they may receive unauthorized messages;
report impersonation or abusive posts to the relevant platform; and
ask the mobile provider about blocking persistent numbers where appropriate.

Uninstalling the app may stop further device access, but it does not necessarily delete information already copied to the lender’s systems.

3. Send a written demand to the lender

Write to the company and its data protection officer, customer-service unit, or official complaints channel. State:

the borrower’s name and account reference;
the exact conduct complained of;
the numbers, accounts, or collection agents involved;
the personal data accessed or disclosed;
the dates and identities of third persons contacted;
the corrective action requested; and
a demand to preserve relevant records while the dispute is pending.

Possible requests include:

stop contacting unrelated third persons;
stop public disclosure and remove existing posts;
identify the company and collection agency responsible;
explain the lawful basis and purpose for processing the data;
provide access to relevant personal data and its recipients;
correct inaccurate information;
block or delete data that has no lawful basis for continued processing;
restrict future communications to a specified lawful channel; and
provide an accurate statement of account.

Do not include more sensitive information than necessary. Keep proof of delivery.

How to complain to the SEC

The SEC accepts complaints concerning lending and financing companies, including alleged violations of the Lending Company Regulation Act, Financing Company Act, Truth in Lending Act, and SEC collection rules.

Use the SEC’s official complaints page for lending and financing companies and follow its current instructions. The SEC presently requires:

a completely accomplished complaint form;
one complaint form for each respondent company;
a copy of a valid government-issued ID; and
supporting documents and evidence.

For email filing, follow the address and prescribed subject-line format shown on the SEC page. The page also gives the current location and hours for personal filing. Because government addresses and submission systems can change, confirm them on that page immediately before filing.

The complaint should clearly identify:

the registered company and app name;
the loan transaction;
the collection agency or numbers used, if known;
each offensive act and its date;
the persons who received disclosures;
the rules allegedly violated;
the evidence attached; and
the action requested.

The SEC may obtain the company’s answer and determine whether an administrative proceeding is warranted. It does not, through this complaint process alone, rewrite payment terms, cancel the debt, declare the contract void, or conclusively invalidate an allegedly excessive interest charge.

How to complain to the National Privacy Commission

First notify the lender in writing

Under the 2021 NPC Rules of Procedure, an NPC complaint generally will not be given due course unless the complainant first:

informs the lender, its processor, or the concerned entity in writing of the privacy violation or personal-data breach; and
shows that the entity failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy, or conduct that is patently illegal. A complainant relying on an exception should expressly state and support the reason.

Prepare a formal complaint

An NPC complaint generally must be written, signed, and verified. It should contain:

the complainant’s identity and contact details;
the respondent’s identity and service details, if known;
a complete narration of material facts;
the particular processing, disclosure, or breach complained of;
supporting documents and witness affidavits, when available;
all reliefs requested;
the written notice previously sent to the respondent;
the respondent’s answer, if any;
proof that 15 calendar days passed without a response, when applicable; and
the required certification against forum shopping.

A representative ordinarily needs a special power of attorney. Filing fees may apply unless an exemption or waiver is available under the rules.

Consult the NPC’s current File a Complaint page for the prescribed forms, payment instructions, and available filing modes. The rules permit filing at an NPC office and recognize personal, registered-mail, courier, and authorized electronic filing, but the current NPC instructions should be checked before submission.

State whether related complaints have been filed with the SEC, BSP, police, NBI, prosecutor, or a court. A certification against forum shopping must be accurate; parallel proceedings should not be concealed.

Complaints involving BSP-supervised providers

If the loan came from a bank, digital bank, e-wallet provider, or another BSP-supervised financial institution, first submit a formal complaint through that provider’s consumer-assistance mechanism and keep its response or proof of nonresponse.

If unresolved, escalate it through the BSP Consumer Assistance Mechanism. The BSP currently provides its Online Buddy, or BOB, and alternatives such as a prescribed complaint form submitted through the channels listed on its official page.

Include:

a summary of the complaint;
the resolution requested;
reliable contact details;
the complaint previously sent to the supervised institution;
the institution’s response, if any; and
all material supporting records.

The Financial Products and Services Consumer Protection Act protects financial consumers against abusive collection or debt-recovery practices by covered financial service providers. Regulatory jurisdiction depends on the provider’s actual identity and supervising agency, not merely the word “loan” in the app.

When to report to law enforcement

Go promptly to the police, the PNP Anti-Cybercrime Group, or the NBI when the conduct involves:

a credible threat to kill, injure, abduct, or damage property;
demands for money accompanied by threats to expose private information;
sexual threats, fabricated intimate images, or threatened publication of intimate material;
hacking, takeover of accounts, identity theft, or impersonation;
stalking or disclosure of a home, workplace, or live location creating a safety risk;
fraudulent payment instructions or requests to send money to suspicious personal accounts; or
falsely manufactured warrants, subpoenas, court papers, or government notices.

For immediate danger, call 911 or proceed to the nearest police station. The NBI also maintains an official online complaint page and provides investigative assistance for victims of computer crimes.

The precise criminal offense depends on the words used, surrounding circumstances, identity of the sender, manner of publication, and available proof. Possible civil, criminal, cybercrime, or data-privacy liability should be assessed from the actual evidence rather than assumed from a single message.

Does harassment cancel the debt?

Usually, no. Collection misconduct and the borrower’s payment obligation are separate issues.

A borrower should obtain and review:

the amount released;
principal, interest, fees, and penalties;
the disclosure statement;
the agreed due dates;
all payments and credits; and
the lender’s legal identity and authority.

Dispute incorrect amounts in writing and request a detailed statement of account. If the obligation is valid, consider proposing a documented repayment arrangement. Pay only through a verified company channel and obtain a receipt. Do not send money merely because an anonymous collector threatens arrest or public humiliation.

Ordinary nonpayment of a loan is not, by itself, proof of a crime. A collector cannot create a warrant, order an arrest, or imprison a borrower through a text message. Fraud allegations, postdated checks, or other special circumstances require separate legal analysis.

Evidence from people in the borrower’s contacts

Relatives, friends, employers, and co-workers who received collection messages should preserve their own copies. Their evidence may be stronger if it shows:

the number or account that contacted them;
the complete wording of the message;
the borrower’s name, photograph, debt, or other data disclosed;
whether the recipient was ever designated as a reference, co-maker, or guarantor;
how often the collector contacted them; and
whether the collector threatened or insulted them personally.

A recipient whose own contact information was harvested or processed may send a separate privacy notice to the lender and, when appropriate, file an NPC complaint as an affected data subject.

Common mistakes to avoid

Deleting the app or messages before preserving evidence. Important details may become impossible to recover.
Complaining only against the app name. Identify the corporation, collection agency, and responsible accounts whenever possible.
Posting IDs and loan records publicly. This can expose more personal data and create additional legal risks.
Assuming that every collection call is illegal. A lender may make a lawful, proportionate demand for payment.
Assuming that permission to access contacts authorizes mass collection messages. NPC rules specifically restrict harvesting contacts for debt collection or harassment.
Filing an incomplete NPC complaint. Verification, prior written notice, proof of the respondent’s response or nonresponse, supporting evidence, and certification against forum shopping are significant procedural requirements.
Ignoring the underlying account. Continue disputing erroneous charges and addressing any valid balance through documented channels.
Paying an unverified collector. Confirm the creditor, authority of the collection agency, amount due, and official payment channel.
Threatening the collector in return. Keep communications factual and preserve your own credibility.
Concealing other pending cases. Disclose related proceedings whenever the applicable form or certification requires it.

When legal help is urgent

Consult a lawyer promptly when:

private or intimate material has been published or is about to be published;
the lender contacted an employer, client, public office, or a large group of people;
threats identify the borrower’s home, child, workplace, or daily movements;
substantial funds were taken through unauthorized transactions;
the lender filed—or claims to have filed—an actual court or criminal case;
a subpoena, summons, warrant, or pleading has been received;
the borrower’s identity or accounts were compromised;
the NPC complaint requires urgent relief or a request to dispense with prior exhaustion; or
several companies, collection agencies, and anonymous accounts are involved.

Bring the original device where possible, backups of the evidence, the loan documents, payment records, a chronology, and copies of all complaints already filed.

Frequently asked questions

May a lending app message everyone in my contacts because I granted contact permission?

No. NPC Circular No. 2020-01 prohibits harvesting, copying, or saving phone, email, or social-media contacts for debt collection or harassment. Character references should be supplied by the borrower through a separate mechanism; general access to the phone’s contact list is not a blank check.

Can the collector post my photograph and label me a scammer?

Using a borrower’s photograph to harass or embarrass the borrower is expressly prohibited by NPC rules. Publicly accusing someone of criminal conduct may also raise separate legal issues depending on the exact statement, audience, intent, and evidence.

Can the lender contact my employer?

Not every communication is automatically unlawful, but disclosing a private debt to an employer or co-workers merely to shame or pressure the borrower may constitute unfair collection and unlawful data processing. Preserve the exact communication and identify everyone who received it.

Can I complain even if I still owe money?

Yes. A valid debt does not excuse harassment or privacy violations. The complaint normally addresses the unlawful collection conduct; it does not automatically cancel the debt.

Can a person who is not the borrower file a privacy complaint?

Potentially, yes. A person whose number was harvested, who was contacted without proper basis, or whose personal data was otherwise processed may be an affected data subject. The person should first document the processing and ordinarily notify the responsible entity in writing.

Should I file with both the SEC and NPC?

Often, yes, when the facts involve both unfair collection and misuse of personal data. Each agency addresses matters within its jurisdiction. Related filings must be disclosed when required, particularly in the NPC certification against forum shopping.

How long should I wait after writing to the lender before filing with the NPC?

The general rule is that the lender or concerned entity must be given an opportunity to act. A complaint may proceed when it failed to take timely or appropriate action or gave no response within 15 calendar days from receipt of the written notice. The NPC may waive exhaustion in qualifying serious or urgent cases.

Will blocking the collector affect my legal rights?

Blocking abusive numbers generally does not waive a complaint, but first preserve the messages and maintain at least one controlled written channel for legitimate account communications. Do not block official court or government notices.

What if the lender is unregistered?

Report the entity to the SEC and include all identifying information, payment accounts, app-store details, websites, and communications. NPC Circular No. 2020-01 may still apply to a person acting as a lender even without the required SEC authority.

Can the SEC order that my entire loan be cancelled?

The SEC’s lending-company complaint page expressly states that its complaint process does not itself change loan terms, settle or cancel the obligation, void the contract, or declare an interest rate invalid. Those issues may require a different proceeding and a review of the contract and applicable law.

Official sources

This article provides general legal information, not legal advice for a particular case. The proper remedy depends on the lender’s identity, the loan documents, the communications, the personal data processed, and the available evidence. Official sources and procedures were checked as of August 25, 2026.