Quick answer

Online lending apps may lawfully collect a valid debt, but they may not threaten, insult, publicly shame, deceive, or misuse personal data to pressure a borrower. Accessing or copying a phone’s contacts and messaging people who are not guarantors is prohibited. A character reference is not automatically a guarantor.

Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission (SEC). Report unlawful collection, disclosure, or use of personal data to the National Privacy Commission (NPC). If there are threats of violence, extortion, impersonation, account hacking, fraud, or immediate danger, report promptly to law enforcement; do not wait for the SEC or NPC process.

A complaint does not automatically cancel the loan. Continue disputing incorrect amounts or arranging lawful payment through the lender’s verified official channel.

What conduct may be unlawful?

SEC Memorandum Circular No. 18, series of 2019 prohibits lending companies, financing companies, and their collection service providers from using unfair collection practices. These include:

Threatening violence, criminal acts, or harm to a person, reputation, or property.
Threatening arrest, criminal prosecution, seizure, or another action that cannot lawfully be taken.
Using obscene, insulting, profane, or abusive language.
Publishing or disclosing a borrower’s name and personal information to shame the borrower.
Communicating loan information known—or that should be known—to be false, including concealing that the debt is disputed.
Using false representations or deceptive methods to collect or obtain information.
Contacting a borrower at unreasonable hours. The circular defines these as before 6:00 a.m. or after 10:00 p.m., subject to its stated exceptions where the account is more than 15 days past due or the borrower expressly agreed that those hours are the only reasonable or convenient opportunity for contact. Those exceptions do not permit threats, abuse, public shaming, or unlawful data use.
Contacting people in the borrower’s contact list other than named guarantors or co-makers, even if the lender claims the borrower allowed access to the contacts.

The broader Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, also gives financial consumers rights to fair treatment, privacy, disclosure, and timely complaint handling. Financial service providers are responsible for their employees and agents and may be solidarily liable with accredited third-party providers involved in debt collection.

Privacy rules specifically governing lending apps

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to observe transparency, legitimate purpose, and proportionality. It also gives a data subject rights to information, access, correction, blocking or erasure in appropriate cases, and damages where legally established.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

A lending app must not require unnecessary or excessive permissions.
Camera or photo access may be used only for a specified, legitimate purpose such as identity verification or know-your-customer requirements. A borrower’s photo must not be used for harassment or embarrassment.
Unbridled access to or processing of phone, email, or social-media contact lists is prohibited.
An app may provide limited access that lets the borrower personally select a character reference or guarantor. It must not freely copy or harvest the entire contact list.
For debt collection, the lender may contact a guarantor who separately and expressly agreed to be one. Contacting other people in the borrower’s contact list is prohibited.
A character reference is supplied only to help verify the applicant’s identity and information. The reference must be told how the details were obtained, must be offered an option to have the data removed, and cannot automatically be treated as a guarantor.
Personal data must be kept only as long as necessary for the stated purpose, legal claims, or a retention period required by law, and must then be securely disposed of.
The lender remains accountable when processing or collection work is outsourced.

The government’s March 2026 joint advisory on online lending platforms reaffirmed these rules for recorded and unrecorded platforms.

Important exceptions

Not every communication about a debt is a privacy violation. A lender may contact the borrower and may make disclosures required or permitted by law—for example, in court proceedings, to an authorized government agency, or through lawful credit-reporting arrangements.

Consent also requires careful examination. Agreeing to a loan or tapping “Allow contacts” does not authorize unlimited collection, public shaming, or harassment. Pre-ticked boxes, obscured choices, or an interface that makes withdrawal unreasonably difficult may undermine the validity of consent.

What to do immediately

1. Preserve evidence before blocking or uninstalling the app

Capture the evidence while it remains available:

Screenshots and screen recordings showing the full messages, sender, date, time, URL, account name, and platform.
Call logs, voicemails, recordings lawfully obtained, and notes identifying what was said.
The app’s name, developer, download page, version, permissions, privacy notice, and terms.
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and customer-service details.
Loan agreement, promissory note, disclosure statement, amortization schedule, statement of account, receipts, and payment confirmations.
Copies of posts, edited photographs, fake notices, threats, or messages sent to relatives, coworkers, employers, and friends.
Screenshots and short affidavits or written accounts from every person contacted.
Your written complaints to the lender and its replies, including delivery receipts or email headers.
Evidence of financial loss, medical treatment, missed work, reputational harm, or security expenses if you may claim damages.

Save copies in at least two secure locations. Keep original files where possible; repeated editing, cropping, or forwarding may remove useful metadata. Do not publicly repost unredacted IDs, account numbers, addresses, or other sensitive evidence.

2. Secure the phone and affected accounts

After preserving the evidence:

Revoke unnecessary permissions for contacts, camera, photos, storage, microphone, location, and call or SMS access.
Change passwords for email, social media, banking, and e-wallet accounts if there is any possibility they were exposed.
Enable multi-factor authentication and review active sessions and recovery details.
Notify the bank or e-wallet immediately if there are unauthorized transactions or compromised credentials.
Remove the app after recording its information and permissions. Revoking access or uninstalling it does not necessarily delete data already copied by the operator.
Report the app or abusive account to the relevant app store or online platform, but retain proof first.

3. Identify the company behind the app

The brand displayed by an app may differ from the corporation that issued the loan. Check the contract, disclosure statement, privacy notice, payment instructions, and app-store listing.

A lending company ordinarily needs an SEC Certificate of Authority to operate. Its advertisements and online platform should disclose its corporate name, SEC registration number, and Certificate of Authority number. If these details are absent, inconsistent, or unverifiable, include that fact in the SEC complaint. Do not assume that an app is legitimate merely because it appears in an app store.

4. Send a written notice to the lender and its data protection officer

Use the verified customer-service and data-protection contacts shown in the contract or privacy notice. State:

Your name and account reference, using only the information necessary to identify the account.
The dates, numbers, accounts, collectors, and exact conduct complained of.
Which contacts were approached and whether they were guarantors, co-makers, or merely character references.
Which personal data was collected, copied, disclosed, or misused.
Whether you dispute the debt, the amount, fees, payments, or identity of the borrower.
Your request to stop contacting non-guarantors, cease abusive communications, correct false information, preserve relevant records, and investigate the collectors involved.
Your request for access to your data, its sources, recipients, purposes, and retention period.
Your request to block, erase, or securely dispose of data that was unlawfully obtained, used for unauthorized purposes, or is no longer necessary, subject to lawful retention requirements.
A request for a written response and confirmation of corrective action.

Keep proof that the company received the notice. This is especially important because an NPC complaint ordinarily requires prior written notice and proof that the respondent failed to take appropriate action or did not respond within 15 calendar days.

Where and how to report

SEC: unfair collection by lending and financing companies

Use the SEC’s official iMessage complaint portal. Select the service for complaints on financing and lending companies under the Financing and Lending Companies Department.

Attach:

A clear chronological narrative.
The lender’s corporate and app names.
Your valid government-issued ID, following the portal’s instructions.
The loan and disclosure documents.
Screenshots, call logs, recordings, witness statements, and proof of third-party contact.
Copies of your written demand and any response.
A description of each prohibited act rather than the word “harassment” alone.

Submit a separate complaint for each respondent company when different companies are involved. Save the electronic ticket number and monitor the portal for requests or deadlines.

The SEC can investigate and impose regulatory sanctions, but its ordinary complaint process does not itself rewrite the loan contract, erase the balance, or automatically declare an interest provision or the entire loan void. Contract validity, contested interest, damages, and repayment liability may require a different proceeding or legal advice.

NPC: unauthorized collection, disclosure, or use of personal data

Before filing, ordinarily notify the lender, collector, or other responsible entity in writing. Under the 2021 NPC Rules of Procedure, as amended, an NPC complaint generally will not be given due course unless:

The complainant informed the respondent in writing of the privacy violation or data breach; and
The respondent failed to take timely and appropriate action or did not respond within 15 calendar days after receiving the notice.

The NPC may waive these requirements for good cause or a serious violation, including circumstances involving grave and irreparable harm, no plain and adequate remedy, or patently illegal action. If the disclosure or threat is continuing, explain and document why immediate NPC intervention is necessary rather than simply omitting the prior-notice requirement.

Download the current NPC Complaint-Affidavit form. Complete it accurately, have it notarized, and attach:

A valid government-issued ID.
Proof of prior written notice and delivery.
All correspondence with the respondent.
Documentary evidence and witness affidavits.
The identity and service details of the respondent, or all available clues if its identity is unknown.
The relief requested.
The required certification against forum shopping, disclosing related proceedings truthfully.

The NPC’s formal complaint page allows submission in person, by courier, or by scanned email to complaints@privacy.gov.ph. Follow the current form for the NPC’s address and submission requirements.

The base NPC complaint filing fee is ₱500, plus the applicable legal research fee and any additional fee based on a damages claim. Exemptions or waivers may apply to qualified indigent complainants and other cases under the amended rules. Confirm the assessment and payment instructions with the NPC rather than sending money to an unofficial account.

An affected contact—not only the borrower—may file an NPC complaint concerning misuse of that contact’s own personal data. A representative generally needs a special power of attorney, subject to the rules for minors and persons who cannot act for themselves.

BSP: when the provider is BSP-supervised

If the loan or credit product is offered by a bank, digital bank, credit-card issuer, e-wallet provider, or another BSP-supervised institution, first complain through that institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.

If unresolved, escalate through the BSP Consumer Assistance Mechanism, using the BSP Online Buddy or a completed Complaints, Inquiries and Requests form sent to consumeraffairs@bsp.gov.ph. Attach proof that you first raised the issue with the institution.

Police, NBI, and cybercrime authorities

Do not wait 15 days where there is immediate danger, a credible threat, extortion, hacking, identity theft, impersonation, fraud, or another possible crime.

Call the nationwide Unified 911 emergency hotline for immediate police, fire, medical, or rescue assistance.
Report cyber-enabled threats, fraud, or harassment to the PNP Anti-Cybercrime Group or NBI Cybercrime Division using the current channels listed in the 2026 joint government advisory.
The DICT Cyber Hotline may be reached through 1326 or 1326@dict.gov.ph.

Bring the original device if requested, but make a secure backup first. Ask for the report, complaint, or blotter reference number.

Your debt and your rights are separate issues

The 1987 Constitution states that no person may be imprisoned for debt. A collector therefore cannot truthfully threaten automatic arrest merely because an ordinary loan remains unpaid.

That rule does not prevent a creditor from filing a lawful civil case, enforcing valid security through proper procedures, or reporting conduct that allegedly constitutes a separate offense. A signed check, mortgage, suspected fraud, identity issue, or court summons can create legal questions independent of the debt itself. Never ignore an authentic subpoena, summons, demand involving collateral, or notice from a court or prosecutor; verify it directly with the issuing office and obtain legal advice promptly.

Harassment or a privacy violation also does not automatically extinguish a valid debt. Request a complete statement of account and pay only through a verified company channel. Be cautious when a collector demands payment to a personal bank or e-wallet account, refuses to issue a receipt, or pressures you to borrow from another app.

Common mistakes to avoid

Deleting messages, uninstalling the app, or resetting the phone before preserving evidence.
Filing a complaint that says only “I was harassed” without dates, names, numbers, quotations, and attachments.
Naming only the app brand and not identifying the corporation, collection agency, and individual accounts involved.
Omitting proof that non-guarantor contacts were approached.
Waiting 15 days before contacting police despite a credible or immediate threat.
Filing an NPC complaint without first giving written notice, without explaining grounds for waiver, or without proof of receipt.
Failing to disclose related SEC, NPC, police, court, or other proceedings in the NPC certification against forum shopping.
Posting unredacted evidence online and creating another privacy or security risk.
Assuming that app-store removal, an SEC complaint, or a privacy complaint automatically cancels the loan.
Sending money, identification, passwords, or one-time PINs to an unverified collector.
Ignoring legitimate court documents because earlier collection messages were fake or abusive.

When legal help is urgent

Consult a lawyer or the Public Attorney’s Office promptly when:

You receive a credible threat of physical harm or threats directed at a child or family member.
Private photographs, IDs, intimate material, medical information, or workplace information have been published or are being used as leverage.
The app appears to have taken over an account, used your identity, or obtained a loan in your name.
You receive an authentic court summons, subpoena, prosecutor’s notice, foreclosure notice, or demand involving collateral.
You signed postdated checks, a mortgage, guaranty, or co-maker agreement.
A large damages claim, business loss, employment consequence, or widespread disclosure is involved.
You need urgent injunctive or protective relief.
Several companies or overseas operators are involved and their identities are unclear.

Frequently asked questions

Can a lending app call my family, friends, or employer?

Not for debt collection merely because their details appear in your phone. Current NPC rules permit debt-collection contact with an expressly consenting guarantor. A character reference is not automatically a guarantor and may be contacted only for limited verification purposes, not pressured to pay. A genuine co-borrower or co-maker may have separate contractual obligations, so the signed documents matter.

Is allowing contact access the same as consenting to message everyone?

No. App permission does not authorize unbridled processing, harassment, public shaming, or contact with non-guarantors. The purpose, necessity, proportionality, and validity of the alleged consent must still comply with privacy law.

Should I uninstall the app immediately?

Preserve the app details, permissions, messages, agreement, and other evidence first. Then revoke unnecessary permissions, secure affected accounts, and remove the app if appropriate. Uninstalling does not guarantee deletion of information already copied.

Can I refuse all communication from the lender?

You may demand that communications remain lawful, accurate, respectful, and directed through a specified reasonable channel. A valid creditor may still send proper demands or pursue lawful remedies. Blocking abusive numbers does not prevent you from communicating through the lender’s verified official channel.

Will filing with the SEC or NPC erase my debt?

No. The agencies may investigate collection and privacy violations, impose sanctions, and grant relief within their authority, but a complaint does not automatically cancel the underlying obligation.

What if the company is unlicensed or I cannot identify it?

Report it anyway. Provide the app name, developer, download link, payment accounts, phone numbers, messages, privacy notice, loan documents, and every other identifying detail. NPC loan-related privacy rules expressly cover persons acting as lenders even without the required SEC authority.

Can an affected contact file a complaint?

Yes. A person whose own contact details or other personal data were collected, used, or disclosed may complain as an affected data subject. The borrower should also preserve that person’s screenshots and obtain an affidavit where practicable.

What penalties may apply?

Depending on the proven violation, regulators may impose administrative fines, cease-and-desist orders, suspension, or revocation of authority. A willful violation of the Financial Products and Services Consumer Protection Act may, after proper prosecution and court proceedings, carry imprisonment of one to five years, a fine of ₱50,000 to ₱2 million, or both. Data Privacy Act penalties depend on the particular offense and type of information involved. Filing a complaint does not guarantee that any specific penalty will be imposed.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rights, liability, procedure, and available relief depend on the contract, communications, data involved, respondent’s identity, and other evidence. Official sources and procedures were checked as of 1 August 2026.