Quick answer

If an online lending app threatens, insults, publicly shames, impersonates authorities, contacts people who are not your guarantors or co-makers, or improperly uses your contacts, photos, location, or other personal data, document everything and report the conduct to the proper agencies:

Report abusive debt collection by a lending or financing company to the Securities and Exchange Commission (SEC) through SEC iMessage.
Report misuse or unauthorized disclosure of personal data to the National Privacy Commission (NPC). Ordinarily, you must first notify the lender or app operator in writing and allow it 15 calendar days from receipt to respond or take appropriate action before filing a formal NPC complaint.
Report credible threats, extortion, impersonation, account hacking, or other possible crimes promptly to the police, the PNP Anti-Cybercrime Group, or the NBI Cybercrime Division. Call 911 if anyone faces immediate danger.

Harassment does not cancel a valid loan, but owing money does not give a lender or collection agent permission to violate collection and privacy laws.

What conduct can be reported?

Collection reminders are not automatically unlawful. A legitimate lender may demand payment, explain the balance, offer payment arrangements, and pursue lawful remedies. The line is crossed when collection becomes abusive, deceptive, excessively intrusive, or unlawfully discloses personal information.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices by covered lending and financing companies include:

Using or threatening violence or other criminal means against a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing or disclosing borrowers’ names and other personal information except where disclosure is legally allowed;
Communicating false loan information, including failing to say that a debt is disputed when required;
Using false representations or deceptive means to collect a debt or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions for accounts more than 15 days past due or times expressly accepted by the borrower through written, electronic, or recorded consent; and
Contacting people in the borrower’s phone contacts who were not named as guarantors or co-makers, even if the borrower supposedly consented to contact-list access.

Examples worth reporting may include messages such as “we will have you arrested today” when no lawful process supports the threat, edited “wanted” posters, messages to an employer announcing the debt, mass texts to relatives or coworkers, threats to harm a child or family member, or demands sent using fake police, court, or government identities.

Whether a particular message is unlawful depends on its exact words, context, recipient, timing, and the lender’s authority. Preserve the original communication instead of relying only on your recollection.

Privacy violations involving lending apps

The Data Privacy Act of 2012 requires personal-data processing to be lawful and consistent with transparency, legitimate purpose, and proportionality. A lender’s legitimate need to evaluate or collect a loan is not unlimited permission to copy, use, or broadcast everything on a borrower’s phone.

The NPC’s loan-related rules—NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02—restrict how lenders and online lending apps may process contact lists. Processing is prohibited when it is used:

For purposes unrelated to assessing creditworthiness, preventing fraud, or collecting the debt;
To collect from people other than guarantors provided by the borrower; or
In a way that results in unfair collection practices.

Subject to those limits, an app may process information about character references or guarantors whom the borrower personally supplies. The app must use a separate interface through which the borrower provides those references; sweeping access to an entire contact list is not the same thing.

Potential privacy violations include:

Uploading or copying the borrower’s full phonebook without a proper legal basis;
Messaging contacts who were never identified as guarantors, co-makers, or references;
Telling relatives, coworkers, clients, or an employer about the debt without lawful justification;
Posting the borrower’s name, photograph, identification document, loan balance, or allegations on social media;
Using photographs, location information, or social-media data for public shaming;
Falsely telling another person that they guaranteed the loan;
Keeping or using data for unauthorized purposes after it is no longer necessary; or
Refusing a valid request for access, correction, blocking, or deletion when the requirements of the Data Privacy Act are met.

Consent is not a blanket defense. It must relate to a specific, lawful purpose, and processing must still be necessary and proportionate. On the other hand, deletion is not automatic merely because a borrower asks for it: a lender may retain information when required by law or when reasonably necessary for a valid contract, accounting obligation, dispute, or legal claim.

What to do immediately

1. Secure your accounts and device

Before uninstalling the app, preserve evidence. Then:

Review and revoke unnecessary permissions for contacts, photos, files, camera, microphone, location, SMS, and call logs.
Change the passwords of your email, mobile-wallet, banking, and social-media accounts if compromise is possible.
Enable multifactor authentication.
Check active sessions and log out unfamiliar devices.
Warn affected contacts not to open links, send money, or provide information to collectors.
Ask contacts to save messages they received rather than immediately deleting or blocking them.

Do not give a collector a one-time password, card PIN, email password, or remote access to your phone.

2. Preserve evidence

Keep copies in at least two secure locations. Save:

Full screenshots showing the sender, number or account, date, time, and complete message;
Screen recordings that show the profile, conversation history, and relevant app pages;
Original emails, text messages, call logs, voice messages, and recordings lawfully in your possession;
Social-media URLs, usernames, post links, comments, and timestamps;
The app’s name, developer, download-page URL, version, privacy notice, permissions, and terms;
Loan agreement, disclosure statement, payment history, receipts, account ledger, and collection notices;
Names and numbers of agents, payment accounts they supplied, and any claimed agency or law-office affiliation;
Messages received by relatives, coworkers, references, or employers;
Your written complaint to the company and proof of delivery; and
The company’s response or proof that 15 calendar days passed without an adequate response.

Avoid cropping out information that helps authenticate a message. If a post may disappear, save the URL and capture it promptly. Ask witnesses to prepare a clear, dated account of what they received and how it affected them.

3. Identify the actual company

The app name may differ from the corporation operating it. Look for the corporate name, SEC registration number, Certificate of Authority number, privacy notice, data-protection contact, and office address.

Use the SEC’s official company-verification resources, including Check with SEC, to investigate whether the operator is registered and authorized. A corporation’s SEC registration alone does not necessarily mean it has authority to operate as a lending or financing company.

Include both the app name and the company name in every complaint. If the operator is unknown, provide all clues you have: app-store link, developer name, website, payment account, phone numbers, email addresses, and screenshots.

Send a written demand to the lender or app operator

Write to the company’s consumer-assistance channel and data protection officer, if identified. Keep the message factual. State:

Your name and account or loan reference;
The dates and descriptions of the conduct;
Which contacts or data were accessed or disclosed;
Which statements are false or disputed;
The harm or continuing risk;
What you want the company to do; and
A request for a written response.

You may request that the company stop contacting unauthorized third parties, remove unlawful posts, correct false information, preserve relevant records, identify recipients of your information, explain the legal basis and purpose of processing, and provide access to personal data covered by your statutory rights.

Do not send passwords, OTPs, or unnecessary identification documents. If identification is reasonably required, ask for a secure submission method and redact information that is irrelevant.

This written notice is especially important for an NPC complaint. Under the 2021 NPC Rules of Procedure, the complainant generally must prove that the company was informed in writing and then failed to take timely or appropriate action, or failed to respond within 15 calendar days after receiving the notice. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

How to complain to the SEC

The SEC regulates lending and financing companies and enforces its rules against unfair debt collection. File through SEC iMessage and select the complaint or concern category applicable to lending or financing activities.

Provide:

Your contact details;
The app and corporate names;
SEC registration and Certificate of Authority numbers, if known;
A short chronological account;
The collector’s exact statements and actions;
The phone numbers, profiles, and payment accounts used;
Copies of the loan documents, payment records, and disputed computations;
Screenshots and messages sent to third parties;
Your prior complaint to the company and its response; and
The specific relief requested, such as investigation and an order to stop prohibited collection conduct.

State separately if you believe the operator is unregistered or lacks authority. Do not describe an app as illegal solely because you cannot find it; ask the SEC to verify its status.

The Financial Products and Services Consumer Protection Act prohibits financial service providers from using abusive collection or debt-recovery practices and requires them to maintain a consumer-assistance mechanism. It also recognizes consumer rights concerning privacy and client-data protection.

An SEC administrative complaint does not itself decide every private dispute over the correct loan balance, damages, or criminal liability. Those issues may require separate proceedings.

How to file a privacy complaint with the NPC

Use the NPC’s current formal-complaint instructions and Complaints-Assisted Form. The NPC presently directs complainants to:

Download and complete the prescribed form.
Print and sign it.
Have it notarized.
Submit it in person, by courier, or as a scanned copy by email to complaints@privacy.gov.ph.

Check the NPC page and its current fee schedule before filing because forms, fees, addresses, and submission instructions may change.

The complaint should identify the complainant and respondent, narrate the material facts, state the relief requested, and attach available evidence. The NPC rules also require supporting correspondence, a certification against forum shopping, and other prescribed components. A representative generally needs a special power of attorney.

Attach:

Your written notice to the company;
Proof that it was received;
The response, or proof that 15 calendar days elapsed without an adequate response;
The privacy notice and relevant app permissions;
Evidence of contact-list access, disclosure, public posting, or messages to third parties;
Affidavits or statements from affected contacts when available; and
Documents identifying the operator and responsible officers.

If immediate processing creates grave and irreparable harm, review the NPC’s procedure for seeking a temporary ban on processing. This is formal relief with evidentiary and procedural requirements; explain the continuing risk and obtain legal assistance where possible.

When to involve law enforcement

Contact law enforcement promptly when the conduct includes:

A credible threat of physical harm;
Extortion or a demand for money tied to a threat to expose data;
Hacking or unauthorized access to an account or device;
Identity theft or impersonation;
Fabricated police, court, or government documents;
Stalking or repeated conduct that creates an immediate safety risk; or
Publication of intimate images or threats to publish them.

Go to the nearest police station or seek assistance from the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Bring identification, a written chronology, the device containing the original evidence, printed copies, and electronic backups. Ask for the complaint or reference number and the investigator’s contact details.

Possible criminal liability depends on the exact conduct and evidence. Privacy, cybercrime, threats, coercion, defamation, or other laws may apply, but filing a report does not guarantee that a particular charge will be brought.

If a threat appears imminent, do not negotiate alone or agree to meet the collector. Move to a safe place and call 911.

What happens to the loan?

Reporting harassment does not automatically suspend payment obligations, erase interest, or invalidate a loan. Continue to:

Request an itemized statement of principal, interest, fees, penalties, and payments;
Review the disclosure statement and due dates;
Pay only through a verified company channel;
Keep every receipt;
Dispute incorrect amounts in writing; and
Propose a realistic restructuring or payment arrangement if needed.

Do not pay a personal account supplied by an unidentified collector without verifying that the company authorized it. Do not borrow from another questionable app merely to stop harassment.

The Constitution prohibits imprisonment for debt, but this does not immunize separate fraudulent or criminal conduct. A collector also cannot lawfully guarantee arrest, conviction, or immediate seizure of property merely because a loan is unpaid. Genuine court papers should not be ignored; verify them with the issuing court and seek legal advice immediately.

Common mistakes that weaken a complaint

Deleting the app, messages, or call history before saving evidence;
Submitting isolated screenshots with no sender, date, or context;
Naming only the app and not attempting to identify its operator;
Making broad accusations without quoting or attaching the actual communications;
Failing to save messages received by relatives or coworkers;
Omitting the written complaint to the company from an NPC filing;
Publicly posting unredacted loan documents or identification cards;
Paying an unverified collector to make threats stop;
Assuming a report automatically cancels the debt; and
Ignoring real notices because earlier messages were abusive or fake.

When legal help is urgent

Seek a lawyer, the Public Attorney’s Office if eligible, or another qualified legal-aid provider urgently when:

A threat involves physical safety, children, employment, or intimate material;
Your identity, bank account, email, or social-media account has been compromised;
The harassment continues after formal notice;
The company has published your data or contacted many third parties;
You receive a subpoena, summons, warrant, or authenticated court filing;
You are asked to sign a waiver, quitclaim, confession of judgment, or settlement you do not understand;
You want damages, an injunction, or a temporary ban on data processing; or
Several agencies, companies, or overseas operators are involved.

Frequently asked questions

Can a lending app contact everyone in my phonebook?

Generally, no. SEC rules treat contact with people in the borrower’s contact list—other than named guarantors or co-makers—as an unfair collection practice. NPC rules also restrict contact-list processing and require references or guarantors to be supplied through a separate interface, subject to lawful-purpose and proportionality requirements.

Can the lender contact my employer?

Not automatically. Whether limited contact is lawful depends on its purpose, necessity, accuracy, the person’s role, and the governing agreement and law. Disclosing the debt to shame or pressure you, or sending false information, may violate collection and privacy rules. Preserve exactly what was communicated.

Does installing the app mean I consented to all uses of my contacts and photos?

No. Permission settings or broad terms do not remove the requirements of lawful purpose, transparency, necessity, and proportionality. The scope and validity of any claimed consent must be assessed against the actual data collected and how it was used.

Must I wait 15 days before contacting the NPC?

For a formal complaint, the usual rule is written notice to the company followed by no timely or appropriate action, or no response within 15 calendar days after receipt. The NPC may waive exhaustion for good cause or serious violations. Urgent safety concerns should be reported to law enforcement immediately; do not wait 15 days.

Can I file with both the SEC and NPC?

Yes, when the facts involve both unfair collection and misuse of personal data. Explain in each filing that another complaint was made and distinguish the issues. A police report may also be appropriate for threats or other suspected crimes.

Should I stop paying because the collector harassed me?

Not solely for that reason. Harassment and the validity or amount of the debt are separate issues. Dispute errors in writing, demand an itemized account, use verified payment channels, and obtain legal advice if the contract or charges may be unlawful.

Can I demand that the app delete all my information?

You may exercise applicable rights to access, correct, block, remove, or destroy data under the Data Privacy Act. Deletion is fact-dependent: a company may retain information required by law or reasonably necessary for a valid contract, regulatory duty, or legal claim. It should not retain or use data indefinitely or for unauthorized purposes.

What if the app has disappeared from the app store?

You may still report it. Preserve the old download link, package or developer name, website, payment records, messages, and corporate details. Removal from an app store does not by itself identify the operator or resolve possible violations.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. Procedures and remedies depend on the evidence, loan documents, identity of the provider, and current agency rules. Official sources and filing information were checked on August 26, 2026.