Quick answer

Yes. You may report an online lending app even if the loan is valid or overdue. Owing money does not authorize threats, insults, public shaming, false accusations, deceptive collection tactics, or misuse of your contacts, photos, and other personal data.

Use the proper channels for each issue:

Report unfair collection by a lending or financing company to the Securities and Exchange Commission (SEC) through its iMessage ticketing system.
Report unauthorized collection, disclosure, or misuse of personal data to the National Privacy Commission (NPC). A formal NPC complaint normally requires prior written notice to the lender and a 15-calendar-day opportunity to respond.
Report credible threats, extortion, impersonation, doxxing, or other possible crimes immediately to the police or the NBI Cybercrime Division. Call 911 if anyone is in immediate danger.
If the credit provider is a bank, digital bank, or another BSP-supervised institution, use its internal complaint mechanism first and then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).

Preserve the evidence before blocking numbers, revoking permissions, or uninstalling the app.

What collection practices are prohibited?

A lender may send lawful payment reminders, demand payment, offer restructuring, engage an authorized collector, and pursue lawful civil remedies. An unpleasant but factual demand is not automatically harassment.

However, SEC Memorandum Circular No. 18, Series of 2019 prohibits lending and financing companies from using unfair collection practices, including:

Using or threatening violence or other criminal means to harm a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing or disclosing borrowers’ names or personal information, except where disclosure is lawfully permitted;
Communicating false loan information or failing to say that a debt is disputed when communicating about it;
Using false representations or deceptive means to collect a debt or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed that those hours are the only convenient time; and
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers. The rule treats this as unfair even if the borrower supposedly consented to contact-list access.

The time-of-day exception does not permit threats, shaming, deception, or other abusive conduct.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, separately requires fair and respectful treatment and prohibits abusive collection or debt-recovery practices. A financial service provider is responsible for the acts of its employees and agents and may also be liable for acts of an accredited third-party collection provider.

What counts as a possible privacy violation?

The Data Privacy Act of 2012 requires a lawful basis and a legitimate, declared purpose for processing personal data. Data collection must also be necessary and proportionate.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, warning signs include:

Copying or processing a borrower’s contacts excessively or using them to harass or shame;
Messaging relatives, friends, co-workers, or employers to disclose the debt or pressure them to make the borrower pay;
Using a borrower’s photograph, identification document, or edited image to embarrass the borrower;
Requesting app permissions that are unnecessary or excessive for the stated loan-processing purpose;
Continuing to access the camera, photo gallery, or another protected resource after the relevant purpose has ended;
Using personal data for an unrelated purpose without another lawful basis;
Giving personal data to an unauthorized collection agency or other third party;
Refusing to explain what data was collected, why it was processed, and to whom it was disclosed; or
Keeping or using inaccurate information after a proper correction request.

Not every request for access to contacts is automatically unlawful. Current NPC rules permit limited access where necessary to let the borrower choose a character reference or guarantor and permit proportionate processing of contact-list metadata. What is prohibited is unbridled, excessive, or disproportionate processing—particularly processing that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantor.

A character reference is not automatically a guarantor. A character reference may be contacted to verify the applicant’s identity and the truth of application information, but not for debt collection, marketing, or cross-selling. A guarantor must separately and expressly consent to undertake the guaranty.

Act quickly, but preserve evidence first

Before deleting messages or uninstalling the app:

Capture the entire communication. Take screenshots that show the message, sender’s number or account, date, time, and surrounding conversation. Save emails with their headers and export chats when the platform allows it.
Document public posts. Save the full URL, account name, posting date, screenshots, comments, and the names of people who received or saw the post. Ask recipients to preserve the original message on their devices.
Record the lender’s identity. Save the app name, developer name, app-store page, privacy notice, website, corporate name, SEC registration number, Certificate of Authority number, office address, and customer-service details. The app brand may differ from the legal entity that granted the loan.
Keep the loan records. Preserve the application, disclosure statement, loan agreement, repayment schedule, payment receipts, account ledger, demands, and any statement showing the amount claimed.
Create a chronology. List each incident by date and time, the collector or number involved, what was said or disclosed, who received it, and any resulting harm.
Preserve technical details. Note the app version, phone model, operating system, permissions granted, and any security alerts. Take screenshots of the permissions before changing them.

Do not secretly record private telephone conversations without legal advice and the required authorization. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Messages, emails, posts, call logs, and voicemails voluntarily sent to you can be preserved without creating a secret recording.

Secure your phone and accounts

After preserving evidence:

Revoke unnecessary access to contacts, camera, microphone, storage, location, and social-media accounts.
Change passwords for your email, banking, e-wallet, and social-media accounts, especially if passwords were reused.
Enable multi-factor authentication.
Check whether unfamiliar apps, device-administrator permissions, accessibility services, or profiles were installed.
Tell affected contacts not to reply, send money, open links, share OTPs, or provide information about you.
Report abusive messages or posts through the platform’s own reporting tools.
Uninstall the lending app if you no longer need it, after preserving evidence.

Revoking permissions or uninstalling the app cannot retrieve data that may already have been copied. It also does not cancel a valid loan.

Send a written complaint to the lender

When it is safe to do so, complain through the lender’s consumer-assistance unit and data-protection officer. Republic Act No. 11765 requires financial service providers to maintain a free consumer-assistance mechanism.

Use email or another channel that produces proof of delivery. Include:

Your name and safe contact information;
The app name, loan account, and legal name of the lender;
A dated account of the incidents;
The numbers, accounts, employees, or collection agency involved;
The specific information disclosed or misused;
Whether you dispute the debt, amount, charges, or identity of the borrower;
Copies of key evidence; and
The action you want taken.

You may request that the lender:

Stop threats, shaming, and third-party contact;
Instruct its collection agency to cease the prohibited conduct;
Remove unlawful posts;
Identify the source, purpose, and recipients of the personal data;
Preserve call logs, access logs, collection instructions, and relevant records;
Correct inaccurate information;
Block or erase unlawfully processed data, subject to lawful retention requirements;
Confirm the correct outstanding balance and provide an account statement; and
Give a written investigation result.

Do not send passwords, PINs, OTPs, or unnecessary identity documents. If an ID is genuinely required, submit it only through a verified official channel and consider marking the copy for the specific complaint purpose.

File a complaint with the SEC

For a lending or financing company, go to the SEC iMessage portal, open a new ticket, and select “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.

The SEC’s current iMessage user guide says the system generates a ticket that can be tracked and used for replies and additional uploads.

Attach, where available:

Your chronology and contact details;
The lender’s corporate and app names;
SEC registration and Certificate of Authority details;
Loan agreement, disclosure statement, and account records;
Screenshots, messages, URLs, call logs, and witness statements;
Proof that relatives, co-workers, or other third parties were contacted;
Your written complaint to the lender and its response; and
A clear request for investigation and appropriate regulatory action.

Name both the lender and the collection agency when the documents identify them. Do not assume that an app is legal merely because it remains available in an app store. If the operator appears unregistered or refuses to reveal its legal identity, say so and provide the identifying details you found.

Keep the ticket number and monitor requests for clarification or additional evidence.

File a privacy complaint with the NPC

A regulatory report or inquiry is different from a formal adjudicative complaint. For a formal complaint, use the NPC’s current complaint page and Complaints-Assisted Form.

The 15-day prior-notice rule

Under the 2021 NPC Rules of Procedure, as amended, you must normally show that:

You informed the lender, its data-protection officer, collection provider, or other responsible entity of the privacy violation in writing; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days from receiving your notice.

The NPC may waive this requirement for proven good cause or a serious violation, including grave and irreparable harm that only NPC action can prevent, lack of a plain and adequate remedy, or conduct that is patently illegal. If harassment or disclosure is continuing and urgent, explain the harm and expressly request a waiver rather than simply omitting the prior-notice requirement.

Formal requirements

The complaint generally must be:

In writing, signed, verified, and notarized;
Filed by the affected data subject or a properly authorized representative;
Directed against an identified respondent, or accompanied by facts that can lead to the respondent’s identification;
Supported by a clear narration, documents, and witness affidavits where available;
Accompanied by your correspondence with the respondent and its response;
Specific about the relief requested; and
Accompanied by a certification against forum shopping and a valid government-issued ID required by the form.

The NPC form instructs complainants to use one complaint form per respondent. Incomplete complaints may be dismissed, so follow the latest form carefully.

A complaint may be filed personally, by registered mail, by courier, or by authorized electronic mail. The NPC’s current filing page allows a scanned, notarized complaint to be emailed to complaints@privacy.gov.ph. Check the NPC contact page for its current office address and contact numbers before filing physically.

The current NPC schedule of fees lists a ₱500 filing fee. Additional fees or bonds may apply if you claim damages or request interim relief. Indigent complainants may qualify for an exemption upon submitting the required proof. Wait for official payment instructions and use only an NPC-authorized payment channel.

If the lender is regulated by another agency

Check the legal entity named in the loan agreement—not merely the app or e-wallet brand.

Bank, digital bank, non-bank electronic-money issuer, money-service business, or other BSP-supervised institution: complain to the institution first. If unresolved, use the BSP Consumer Assistance Mechanism, including BSP Online Buddy or the CIR form sent to consumeraffairs@bsp.gov.ph.
Cooperative: use its internal consumer-assistance mechanism and escalate the financial-services complaint to the Cooperative Development Authority.
Privacy violation by any type of lender: the NPC may still have jurisdiction under the Data Privacy Act, even when another financial regulator supervises the lender.

The SEC, BSP, CDA, and NPC address different aspects of the same incident. Filing with one does not necessarily replace the appropriate complaint to another.

Report threats and possible crimes

Do not wait for a lender’s response if there is a credible threat of violence, extortion, stalking, unlawful entry, identity theft, or another immediate danger. Call the nationwide emergency number 911, as confirmed by the DILG’s Unified 911 guidance, or go to the nearest police station.

For cyber-enabled conduct, you may also:

Use the NBI Online Complaint portal;
Contact or visit the NBI Cybercrime Division; or
Seek assistance from the DOJ Office of Cybercrime.

Bring your identification, device, chronology, screenshots, URLs, account names, phone numbers, loan documents, and copies of any SEC or NPC filing. Ask how to preserve and submit the original electronic evidence.

Depending on the exact words, conduct, intent, and evidence, threats or coercive conduct may implicate the Revised Penal Code, while online publication or unlawful data processing may raise other criminal or civil issues. The correct charge is fact-specific and should be determined by investigators, prosecutors, or a lawyer.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence;
Complaining only about the app brand without identifying the actual lender;
Posting your complete loan agreement, ID, phone number, or private screenshots publicly;
Secretly recording calls without checking the Anti-Wiretapping Act;
Filing an NPC complaint without proof of written prior notice or without explaining why a waiver is justified;
Sending only selected screenshots that omit dates, sender details, or context;
Paying a collector through a personal account or unverified payment link;
Treating a character reference as though that person agreed to guarantee the debt;
Ignoring a real summons, subpoena, court notice, or regulatory communication; and
Assuming that reporting harassment automatically cancels the debt.

Continue paying through a verified official channel if you accept the debt and can pay. If the amount is disputed, state the dispute in writing and request a complete computation. Do not make admissions or sign a restructuring agreement you do not understand.

When legal help is urgent

Consult a lawyer promptly if:

A collector threatens physical harm, arrest without lawful basis, or damage to property;
Your ID, photograph, address, workplace, or family information has been posted publicly;
Someone impersonates a police officer, court employee, lawyer, or government agency;
The loan was opened through identity theft or an unauthorized transaction;
You receive an actual summons, subpoena, warrant, or formal demand with a deadline;
The lender continues contacting third parties after written notice;
You need an NPC temporary ban, cease-and-desist relief, damages, or a court injunction; or
You are considering a criminal complaint or civil action.

Qualified indigent persons may seek free assistance from the Public Attorney’s Office. The Integrated Bar of the Philippines also maintains legal-aid contact channels.

Frequently asked questions

Can I complain even if I really owe the loan?

Yes. The validity of the debt and the legality of the collection method are separate questions. Reporting harassment does not erase a valid balance, but an overdue account does not authorize unlawful collection.

Can an online lender contact my family, friends, or employer?

A guarantor may be contacted about the guaranteed obligation. A character reference is not a guarantor and may be contacted only for permitted verification purposes. Mass messaging, shaming, or disclosing the debt to people in the borrower’s contact list who are not guarantors is prohibited.

Is any access to my contacts automatically illegal?

No. Limited, necessary access may be permitted to let you select a character reference or guarantor, and proportionate contact-list metadata may be processed for a legitimate purpose. Copying or using contacts excessively, for harassment, or to collect from non-guarantors is prohibited.

Are late-night collection calls always prohibited?

SEC rules define calls before 6:00 a.m. or after 10:00 p.m. as unreasonable unless the account is more than 15 days past due or the borrower expressly agreed that those hours are the only convenient time. Threats, insults, deception, and shaming remain prohibited regardless of the hour.

Should I block the collector immediately?

Preserve the messages, account details, and call history first. You may then block abusive numbers, but keep at least one safe written channel open if you need account statements, a written investigation result, or settlement information.

Can the NPC order all my information deleted?

You may request erasure or blocking where legally justified, but the right is not absolute. A lender may have lawful reasons to retain some records for an existing obligation, legal claim, regulatory requirement, or prescribed retention period. Continued use or disclosure must still have a lawful and proportionate basis.

Can I be jailed simply because I cannot pay?

No person may be imprisoned for debt alone under Article III, Section 20 of the 1987 Constitution. This does not prevent civil collection or prosecution for a separate offense supported by evidence, such as an independently committed fraud. A collector should not falsely threaten automatic arrest merely for nonpayment.

Must I wait 15 days before going to the police or SEC?

No. The 15-calendar-day requirement discussed above is the NPC’s usual prior-notice requirement for a formal privacy complaint. It does not require you to delay an emergency report, criminal complaint, or SEC regulatory report. The NPC itself may waive prior notice in serious, urgent cases when the grounds are properly explained and proved.

This article provides general Philippine legal information, not legal advice for a specific loan, complaint, or criminal case. Outcomes depend on the documents, communications, identity of the lender, and surrounding facts. Official sources and filing channels were checked on 6 August 2026.