Quick answer

If an online lending app, lending company, financing company, or its collection agent is threatening you, publicly shaming you, misusing your photo or personal information, or contacting people in your phone to pressure you to pay, you can report the conduct even if you genuinely owe the loan.

The important point is that a valid debt does not give a lender unlimited authority to harass a borrower or misuse personal data. Philippine rules regulate both debt-collection conduct and the processing of borrowers’ information. Current privacy rules specifically restrict the use of phone contacts and distinguish a mere character reference from a person who actually agreed to be a guarantor.

As a practical matter:

Preserve the evidence before deleting messages, blocking numbers, or uninstalling the app.
Identify the lending company, app operator, and collection agency, if any.
Send a written complaint or demand to the lender or operator, particularly if personal data is being misused.
Report unfair collection practices involving a lending or financing company to the Securities and Exchange Commission (SEC).
File a privacy complaint with the National Privacy Commission (NPC) when your personal data, contacts, photographs, or other information have been improperly processed or disclosed. As a general rule, the NPC requires you first to notify the respondent in writing and give it an opportunity to act; a complaint may ordinarily proceed when there is no response within 15 calendar days from receipt, or when the response is not timely or appropriate. The NPC may waive this requirement for good cause or in serious cases. (National Privacy Commission)
Go to the police, PNP Anti-Cybercrime Group, or NBI Cybercrime Division when the conduct involves threats, extortion, account intrusion, impersonation, or other circumstances that may constitute a crime. (ACG PNP)

These remedies can overlap. A single collection campaign may involve an SEC regulatory issue, an NPC privacy violation, and potentially a criminal complaint, depending on what actually happened.

What online lending practices can be reported?

Not every demand for payment is harassment. A lender may lawfully remind a borrower about a legitimate obligation and may pursue remedies available under the loan agreement and Philippine law.

The problem arises when collection methods cross legal and regulatory limits.

Threats, intimidation, and abusive collection

The SEC's rules on financing and lending companies prohibit unfair debt-collection practices. The government's 2026 joint advisory on online lending platforms likewise identifies harassment, intimidation, public shaming, threats, and unlawful use of borrowers' personal information as continuing regulatory concerns. It specifically describes improper collection conduct as including threats of violence or criminal means intended to harm a person's reputation, property, or person, as well as threats to take action that cannot legally be taken. (National Privacy Commission)

Potentially reportable conduct may therefore include circumstances such as:

threatening physical harm to the borrower or another person;
threatening to destroy someone's reputation or property;
using insulting, degrading, or intimidating messages as a collection tactic;
publicly exposing or humiliating a borrower to pressure payment;
threatening legal, police, or other governmental action that the collector cannot actually or lawfully take;
falsely presenting a collector as a court, police officer, prosecutor, lawyer, or government agency;
using personal information obtained from the app as a weapon for collection; or
repeatedly contacting third persons who are not guarantors to pressure or embarrass the borrower.

Whether particular conduct violates a statute or regulation depends on the exact messages, frequency, recipients, context, and identity of the lender or collector. Preserve the actual communications rather than relying only on a later description of what occurred.

A lending app cannot freely use everyone in your contact list

One of the most important current rules concerns phone contacts.

NPC Circular No. 2022-02 amended the rules governing online lending applications. It does not create an absolute rule that an app can never interact with contact information. Instead, it requires any access or processing to be suitable, necessary, proportionate, and non-excessive for a legitimate purpose. Online lending apps must avoid unrestricted or excessive processing of contact lists and should use limited interfaces when borrowers themselves select references or guarantors.

Most importantly, there is a difference between a character reference and a guarantor.

A character reference may be contacted for the limited purpose of verifying the borrower's identity or the truthfulness of information supplied by the borrower. Merely being listed as a reference does not automatically make that person a guarantor.

A guarantor, by contrast, must have expressly consented to act as one. For debt-collection purposes, the current NPC rule allows the lender to contact the guarantor but prohibits using the borrower's wider contact list to pursue collection from other persons.

Thus, if an app sends messages to dozens of friends, relatives, coworkers, employers, or other saved contacts merely to shame or pressure the borrower, the fact that the borrower once allowed the app some access to contacts does not by itself make the collection campaign lawful.

Giving an app permission is not blanket consent to harassment

Borrowers sometimes assume that because they tapped “Allow Contacts,” “Allow Photos,” or a similar permission during installation, the lender can use everything it obtained in any manner it chooses.

That is not how Philippine data-privacy law works.

The Data Privacy Act requires personal-data processing to comply with principles including transparency, legitimate purpose, and proportionality. Personal information collected must be adequate, relevant, suitable, necessary, and not excessive in relation to the declared purpose. (National Privacy Commission)

The NPC's online-lending rules additionally require app permissions to be appropriate and necessary. Access should occur only when it is actually needed for the relevant function. Once the purpose has been achieved and no lawful basis remains, the rules contemplate revocation of unnecessary permissions.

The rules also specifically prohibit using a borrower's photograph to harass or embarrass the borrower in collecting a delinquent loan.

Accordingly, consent to legitimate data processing is not an unlimited authorization to:

publish a borrower's photograph as a “warning” or shaming device;
message everyone stored in the borrower's phone;
disclose loan details indiscriminately;
use personal information for threats or humiliation; or
continue unnecessary processing simply because an app previously obtained a permission.

The legality of particular processing can still depend on the purpose, information involved, disclosures made to the borrower, other lawful bases for processing, and regulatory or record-retention obligations.

Step 1: Preserve evidence before you block, delete, or uninstall

A regulatory agency can act more effectively when the complaint shows what happened, who did it, when it happened, and how the conduct is connected to the lender.

Before removing the app or deleting anything, preserve as much of the following as is reasonably available:

screenshots of texts, chat messages, emails, social-media posts, and app notifications;
the sender's phone number, account name, profile, email address, or other identifier;
dates and times of calls and messages;
complete message threads, not merely selected excerpts;
call logs and lawful copies of voicemail or other communications already in your possession;
screenshots of public posts, including the profile making the post, date, URL, and surrounding context;
the app's name, logo, developer name, app-store listing, website, and version if visible;
screenshots of the permissions requested by the application;
the app's privacy notice and terms, if available;
loan agreement, disclosure statement, promissory note, or other loan documents;
payment records and receipts;
statements showing the amount the collector claims is due;
the names of the lending company and any outside collection agency;
evidence showing where payments were requested to be sent; and
copies of communications sent to the borrower's relatives, friends, coworkers, references, or other third persons.

If another person received the offending message, ask that person to preserve the original message on the receiving device and make a screenshot showing the sender and date. A screenshot forwarded by the borrower may be less useful than evidence from the actual recipient.

Prepare a simple chronology containing the date, sender, recipient, conduct complained of, and corresponding screenshot or attachment number.

Do not unnecessarily repost humiliating material on social media merely to prove that it exists. Doing so may spread the same personal information you are trying to protect.

Step 2: Identify the actual company behind the app

The name appearing on the app icon may not be the complete corporate name of the lender.

Look for the legal entity in:

the loan agreement;
disclosure statement;
privacy notice;
app-store developer information;
collection notices;
payment instructions;
email footer;
company website; and
SEC registration or online-lending-platform records.

Lending companies in the Philippines are subject to SEC regulation and generally require the appropriate SEC authority to engage in lending activities. The SEC also publishes information concerning recorded online lending platforms and advisories involving unauthorized, suspended, or revoked operators. (SEC Appointment System)

Record both names when they differ—for example, “ABC Lending Corporation, operating the XYZ Loan app.”

If a separate collection agency is involved, identify it as well. Outsourcing collection does not make privacy and collection rules irrelevant. Include evidence connecting the collector with the lender whenever possible.

An app that cannot clearly identify the company behind it deserves additional scrutiny. Do not send money to an unfamiliar personal bank or e-wallet account solely because an anonymous collector threatens you. Verify the creditor and authorized payment channel first.

Step 3: Send the lender a written complaint

For an NPC privacy complaint, this step is particularly important.

The NPC's current complaint rules generally require the complainant first to inform the respondent in writing of the privacy violation or personal-data breach and provide the respondent an opportunity to address it. If the respondent fails to take timely and appropriate action, or fails to respond within 15 calendar days from receipt, the complainant may proceed before the NPC. Proof that the written notice was sent and received should be preserved. (National Privacy Commission)

A written complaint to the lender or operator should identify:

your name and account or loan reference, if appropriate;
the app and corporate lender involved;
the dates and numbers or accounts used by collectors;
the specific conduct complained of;
the personal data allegedly accessed, used, or disclosed;
the third persons contacted;
screenshots or other supporting evidence;
why you believe the collection or data use is improper; and
what corrective action you are requesting.

Depending on the situation, you may request that the lender:

stop threatening or humiliating communications;
stop contacting persons who are not valid guarantors for debt-collection purposes;
remove public posts containing your personal information;
explain how it obtained and used particular data;
identify the persons or entities to whom the information was disclosed;
identify its collection agency;
correct inaccurate account information;
restrict or stop processing that lacks a lawful basis;
delete information when you have a valid right to erasure and no lawful retention ground prevents deletion; and
confirm in writing what corrective measures were taken.

Do not demand deletion of every record merely because a dispute exists. A lender may have legitimate legal or regulatory grounds to retain particular loan and transaction records. Privacy rights must be applied to the particular information and purpose involved.

Send the complaint through a channel that produces evidence of delivery—such as an acknowledged email, registered mail, courier receipt, or an official customer-support system showing a ticket or reference number.

Step 4: Report unfair lending or collection practices to the SEC

For complaints involving lending companies, financing companies, their online lending platforms, or prohibited collection practices, the Securities and Exchange Commission is a principal regulatory authority.

The SEC currently uses its iMessage SEC-Wide Ticketing System for, among other matters, complaints handled by the Financing and Lending Companies Department. The SEC's own user guidance identifies the route under the department's Legal and Enforcement Division for complaints on financing and lending companies. (Securities and Exchange Commission)

When filing, provide a coherent package rather than only writing “they are harassing me.” Include:

the legal name of the lending or financing company, if known;
app name;
loan or account information needed to identify the transaction;
collector's name and contact details;
chronology;
screenshots;
call logs;
messages sent to third persons;
any public-shaming posts;
your prior complaint to the company;
the company's reply, if any; and
information showing that the app may be unrecorded or the operator unauthorized, when relevant.

Privacy violations can separately be brought to the NPC. The existence of one regulatory avenue does not necessarily prevent reporting a different aspect of the same conduct to another agency with jurisdiction.

The SEC also notes that allegations amounting to civil or criminal wrongdoing may ultimately require action before the proper courts or law-enforcement authorities rather than being resolved entirely through the SEC's administrative process. (SEC Appointment System)

Step 5: File a privacy complaint with the National Privacy Commission

The National Privacy Commission is the primary agency for complaints involving violations of the Data Privacy Act and related privacy regulations.

Examples particularly relevant to online lending include alleged:

excessive access to contacts;
unauthorized disclosure of personal information;
dissemination of photographs for shaming;
collection messages sent to non-guarantors using information harvested from a phone;
use of character references for debt collection rather than permissible verification;
excessive or disproportionate processing of personal data; and
continued unlawful processing after a complaint or objection.

The usual 15-day prerequisite

Before formally proceeding with a complaint, you ordinarily must have notified the respondent in writing.

The current NPC mechanics provide that the respondent must have failed to take timely or appropriate action, or 15 calendar days must have passed from receipt without a response. Attach evidence of the notice and receipt to the complaint. (National Privacy Commission)

This does not mean that every complainant must remain exposed to serious ongoing harm for 15 days. The NPC's Rules of Procedure permit the Commission to waive the exhaustion requirement for good cause or where a serious violation warrants immediate regulatory intervention, considering factors such as grave or irreparable damage and the absence of a plain, speedy, and adequate remedy.

If the situation involves rapidly spreading personal information, credible threats, or similarly serious circumstances, document why immediate action is necessary.

Use the current NPC complaint form

The NPC requires a properly accomplished and notarized complaint document—either its prescribed complaint form or a verified complaint—together with supporting evidence and, when appropriate, affidavits of witnesses.

The NPC has introduced an updated Complaint-Affidavit template, so complainants should download the current form from the NPC itself rather than using an old copy found elsewhere online. The NPC currently accepts complaint submissions through the filing methods identified on its official complaint page, including its complaints email and physical filing channels. (National Privacy Commission)

Filing fees may apply under the NPC's current schedule and procedures. Because fee requirements can change and may depend on the filing, check the current NPC Schedule of Fees and complaint instructions when filing rather than relying on an old amount.

The NPC may dismiss a complaint that is materially deficient in form, substance, or evidence. A detailed, organized filing with documentary proof is therefore preferable to a bare allegation. (National Privacy Commission)

If a violation is established, available consequences depend on the provision violated and the facts. The NPC may impose or pursue appropriate administrative remedies and sanctions, and where the evidence warrants prosecution for an offense, it may refer the matter for criminal proceedings in accordance with law. (National Privacy Commission)

Step 6: Contact law enforcement when threats or possible crimes are involved

Some online lending disputes are primarily regulatory. Others may involve conduct that potentially violates criminal laws.

Consider promptly approaching law enforcement when there are circumstances such as:

credible threats of physical injury;
demands for money accompanied by threats unrelated to lawful debt collection;
blackmail or extortion;
hacking or unauthorized access to accounts or devices;
identity theft or impersonation;
fabricated police, court, prosecutor, or government notices;
unlawful takeover of an email, social-media, e-wallet, or other account;
publication of sensitive material coupled with threats; or
continuing conduct that creates an immediate safety risk.

The PNP Anti-Cybercrime Group publishes official channels for cybercrime complaints, while the NBI Cybercrime Division accepts requests for investigative assistance from victims of computer-related offenses. (ACG PNP)

Not every insulting message constitutes a criminal offense, and not every privacy violation is automatically a cybercrime. The exact offense, if any, depends on the words used, acts committed, intent, surrounding circumstances, and available evidence.

If there is an immediate threat to someone's physical safety, prioritize getting to the nearest appropriate law-enforcement authority rather than waiting for the completion of an administrative complaint.

What if you really owe the loan?

You may still complain.

There are two separate questions:

Does the borrower have a valid unpaid obligation?
Did the lender or collector use lawful methods to collect it?

A genuine debt does not authorize unlawful threats, public shaming, indiscriminate disclosure of personal information, or prohibited contact-list collection.

At the same time, reporting harassment does not automatically cancel the loan, erase principal or lawful charges, or prevent the creditor from using legitimate remedies.

If you acknowledge the obligation, continue dealing with it through verified official channels. If you dispute the balance, request an account statement and raise the dispute in writing. Keep evidence of payments.

Do not treat a regulator complaint as a substitute for addressing a legitimate loan obligation.

What if you are the friend, relative, coworker, or reference being contacted?

You do not have to be the borrower to preserve evidence or raise a concern about misuse of your own personal information.

If you receive a collection message regarding someone else's loan:

keep the original message;
preserve the sender's number or account;
note whether the message disclosed the borrower's debt or other personal information;
do not assume you became liable merely because the borrower listed you as a reference;
ask whether you ever expressly agreed to act as a guarantor; and
if your own personal data is being unlawfully processed, consider your own rights as a data subject.

Under the current NPC rule, a character reference is not automatically a guarantor. A reference may be contacted for identity or veracity verification, but debt collection against contacts is limited to a person who expressly consented to act as guarantor.

What if the collector claims it will have you immediately arrested?

Do not assume a threatening text accurately states Philippine law.

A collector's threat should be evaluated according to the actual nature of the obligation and any alleged offense. Mere inability or failure to pay an ordinary civil debt does not mean a private collector can simply order someone's arrest.

At the same time, certain loan-related conduct can raise separate legal issues depending on the facts—for example, allegations involving checks, fraud, falsified documents, or some other independent offense. It is therefore safer to evaluate the actual documents and allegations than to make an absolute assumption based solely on the collector's message.

If the message claims that a warrant, criminal case, subpoena, court order, or government proceeding already exists, ask for the exact case number and issuing court or agency and verify it independently through official channels.

Preserve fabricated-looking legal notices because falsely invoking government authority may itself become important evidence.

What if the app is unregistered, unrecorded, or impossible to identify?

Preserve every clue that may identify the operator:

app-store developer name;
website domain;
privacy-policy entity;
email addresses;
phone numbers;
payment account names;
bank or e-wallet destinations;
loan contract;
SMS sender IDs;
social-media accounts; and
screenshots of the app's profile and listing.

Check the SEC's current lending and financing-company information and online-lending advisories. If the operator appears unauthorized or cannot be matched to the entity represented to you, include that fact in your SEC report rather than trying to resolve the corporate identity yourself. (Securities and Exchange Commission)

Where the same unknown operator has also misused personal data, the privacy evidence may separately be relevant to the NPC. Where fraud, impersonation, hacking, extortion, or threats are involved, preserve the financial trail and report the matter to the appropriate law-enforcement authority as well.

What relief should you ask for?

Be specific. Depending on your situation and the authority involved, you can ask for appropriate action concerning:

cessation of harassing communications;
cessation of collection messages to non-guarantor contacts;
removal of unlawful public posts;
correction of inaccurate personal or account information;
disclosure of the identity of the company and collection agency processing your data;
an explanation of the purpose and legal basis for particular processing;
information concerning recipients to whom data was disclosed;
restriction or termination of unlawful processing;
deletion or erasure where legally available;
preservation of relevant records while the complaint is being investigated;
regulatory investigation and appropriate sanctions; and
referral to the proper authority if the evidence indicates a possible criminal offense.

Do not assume that every requested remedy will be granted. Data erasure, for example, may be limited when information must legitimately be retained for a legal claim, regulatory obligation, contract, or another lawful purpose.

Common mistakes that weaken a complaint

Deleting everything before taking screenshots

Blocking the collector may stop an immediate disturbance, but first preserve the relevant evidence if it is safe to do so.

Uninstalling the app immediately

Before uninstalling, document the app name, developer, permissions, privacy notice, account screen, loan information, and other information that may later be difficult to recover.

After preserving evidence, consider revoking unnecessary permissions, particularly if continued access creates a security or privacy risk.

Filing a vague complaint

“Your agent harassed me” is less useful than a chronological presentation identifying the number used, exact message, date, recipient, and attached screenshot.

Assuming that everyone listed as a reference is a guarantor

They are not. Express consent to act as guarantor matters.

Filing an ordinary NPC complaint without first notifying the lender

Unless circumstances justify waiver of the exhaustion requirement, send the written notice first and retain proof that it was received. The 15-calendar-day rule runs from receipt, not merely from the date you typed or sent an unverified message. (National Privacy Commission)

Using an outdated NPC complaint form

Obtain the current Complaint-Affidavit or complaint form directly from the NPC website. (National Privacy Commission)

Posting all evidence publicly

Publicly uploading your IDs, loan records, phone number, private conversations, or the names and numbers of your contacts may create additional privacy problems. Submit complete evidence privately to the proper authority instead.

Assuming the complaint wipes out the debt

Collection misconduct and the underlying loan obligation are separate issues.

Paying an unverified personal account because of a threat

Confirm that the payment destination is officially authorized by the actual lender. Keep receipts for every payment.

When legal help may be urgent

Consider getting individualized legal assistance promptly if:

a collector has made a credible threat of violence;
intimate, highly sensitive, or identity-related information is being published or threatened with publication;
hundreds of people are being contacted or a damaging post is spreading rapidly;
an employer, business, or professional reputation is being deliberately targeted;
a collector is impersonating a court, police agency, lawyer, or government official;
money is being demanded under circumstances suggesting extortion;
an account, device, SIM, email, or e-wallet appears compromised;
a real summons, subpoena, warrant, or court document has been received;
you need urgent injunctive or other judicial relief;
substantial financial loss has occurred; or
several companies or collectors are involved and responsibility is unclear.

Administrative complaints can be valuable, but they do not replace immediate protective action where there is danger or a need for urgent court relief.

Frequently asked questions

Can an online lending app contact my family and friends because I have not paid?

For debt collection, current NPC rules do not permit indiscriminate contact with people found in the borrower's contact list. A lender may contact a person who expressly consented to act as guarantor. A character reference may be contacted for limited identity or veracity verification but is not automatically a guarantor.

What if I gave the app permission to access my contacts?

That does not create unlimited permission to use all contacts for collection. Personal-data processing must remain necessary, proportionate, and consistent with a legitimate purpose, and current online-lending rules prohibit unrestricted or excessive contact-list processing.

Can I complain even if I am months behind on my loan?

Yes. The existence of an unpaid debt and the legality of the collection method are separate questions. A complaint about harassment or privacy violations does not, however, automatically eliminate the debt.

Should I complain to the SEC or NPC?

Often the answer is both, for different issues. The SEC handles regulatory matters involving lending and financing companies and unfair collection practices. The NPC handles personal-data and privacy violations. Police or the NBI may become relevant where facts suggest a criminal offense.

Do I have to wait 15 days before complaining to the NPC?

Ordinarily, you must first notify the respondent in writing and show that it failed to take timely and appropriate action or did not respond within 15 calendar days from receipt. The NPC may waive this requirement for good cause or sufficiently serious violations. (National Privacy Commission)

Can a lending app use my photo to shame me for an unpaid loan?

The NPC's current online-lending rules specifically prohibit using the borrower's photograph to harass or embarrass the borrower as a means of collecting a delinquent loan.

Is a character reference responsible for my debt?

Listing someone as a character reference does not automatically make that person a guarantor. Current NPC rules require express consent before a person is treated as a guarantor.

What should I do if the harassment stopped after I paid?

Preserve the evidence anyway. Payment does not retroactively determine whether past collection or data-processing practices were lawful. Whether further regulatory, civil, or other remedies are worthwhile will depend on the seriousness of the conduct, evidence, resulting harm, and applicable legal periods.

What if the lender deletes the messages?

Your screenshots, recipient copies, call records, emails, URLs, payment records, and contemporaneous chronology may still be important. This is why evidence preservation should come before blocking or deleting whenever reasonably possible.

Official sources and filing channels

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for advice based on the facts and documents of a particular case. The proper agency, legal theory, available relief, and procedural requirements can differ depending on whether the lender is an SEC-regulated lending or financing company, another type of financial institution, an unauthorized operator, or an unidentified actor. Regulatory forms, filing channels, and fees may also change.

Legal and official-source information checked as of 26 August 2026.