Quick answer

If an online lending app, lender, or collection agent is threatening you, publicly shaming you, contacting people who did not agree to be guarantors, or misusing your phone data, document the conduct and report it through the channel that matches the violation:

Unfair or abusive debt collection: File a complaint with the Securities and Exchange Commission’s Financing and Lending Companies Department through the SEC iMessage portal. The SEC hotline is 1-4732 (1-4SEC).
Unauthorized collection, access, use, or disclosure of personal data: First send the company a written privacy complaint and ordinarily allow 15 calendar days from its receipt for an appropriate response. If it does not respond or act appropriately, file a formal complaint with the National Privacy Commission.
Threats, fraud, impersonation, extortion, or other possible crimes: Report the matter promptly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. If anyone faces immediate physical danger, contact the police or emergency services at once.

You may use more than one channel because the same conduct can involve unfair collection, a privacy violation, and a possible criminal offense. Reporting harassment does not automatically cancel a legitimate debt, but owing money does not give a collector the right to threaten, humiliate, deceive, or unlawfully expose your information.

What online lenders and collectors are prohibited from doing

The Data Privacy Act of 2012, NPC rules for loan-related transactions, the Financial Products and Services Consumer Protection Act, and SEC debt-collection rules impose overlapping protections.

Misusing contacts and other phone data

An online lending platform may not engage in unnecessary, excessive, or disproportionate processing of personal data. Under the government’s current Advisory on Online Lending Platforms:

Unrestricted or excessive processing of a borrower’s contact list is prohibited.
A lender may not contact people in the borrower’s contact list for debt collection unless they were identified as guarantors and actually consented to that role.
A character reference provided only for identity or verification purposes is not automatically a guarantor.
The platform should provide separate ways to identify character references and consenting guarantors.
Permissions for a camera, photo gallery, or similar device feature must serve a specified and legitimate purpose. Once that purpose has been completed, the platform should prompt the user to disable or revoke the permission.
Borrower data may be retained only as long as necessary for its stated purpose, for legal claims, or as required by law, after which it must be securely disposed of.

Consent to a privacy notice does not give a lender unlimited authority to harvest a phonebook, shame a borrower, or message unrelated third parties. Whether particular processing was lawful still depends on its stated purpose, necessity, proportionality, transparency, and applicable legal basis.

Harassing, deceptive, or humiliating collection

For lending and financing companies subject to SEC supervision, prohibited practices include:

Using or threatening violence or other criminal means against a person, reputation, or property;
Threatening an action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing or disclosing borrowers’ names or personal information outside lawful exceptions;
Communicating false loan information, including failing to say that a debt is disputed when that qualification is required;
Using false representations or deceptive means to collect a debt or obtain information about a borrower;
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers; and
Ordinarily making contact before 6:00 a.m. or after 10:00 p.m.

SEC Memorandum Circular No. 18, series of 2019, contains limited exceptions concerning collection hours, including where an account has been past due for more than 15 days or the borrower has expressly agreed—through written, electronic, or recorded means—that those hours are the only reasonable or convenient times. That exception does not authorize threats, humiliation, deception, or contact with unrelated people.

Financial service providers are also expressly prohibited from using abusive collection or debt-recovery practices under the Financial Products and Services Consumer Protection Act.

What to do immediately

1. Protect yourself before confronting the collector

If a message contains a credible threat of violence, identifies your home or workplace, threatens a family member, or shows that someone is being followed, prioritize safety. Go to a secure place, tell trusted people, and contact the police. Do not arrange an in-person meeting with the collector merely to obtain more evidence.

If the threat is not immediate, avoid arguing or making threats in return. A short written response is generally more useful than a heated call because it creates a record.

2. Preserve the evidence

Save evidence before blocking accounts, changing devices, uninstalling the app, or deleting messages. Preserve:

Full screenshots showing the sender, date, time, account name, phone number, and complete message;
Original text messages, emails, chat threads, voice messages, and call logs;
Screen recordings showing the account profile and surrounding conversation;
Posts, comments, group messages, or altered photographs used for public shaming;
URLs and the names of pages, groups, accounts, and recipients;
The app’s name, developer, download page, version, and privacy notice;
Screenshots of every permission requested by the app;
The loan agreement, disclosure statement, payment schedule, receipts, and account ledger;
Collection notices and any demand for payment to a personal bank or e-wallet account;
Names or aliases used by collectors and the company they claimed to represent;
Statements or screenshots from relatives, coworkers, employers, or other third parties who were contacted;
Your written complaint to the company, proof it was received, and its response; and
SEC or NPC registration information and ticket numbers, if available.

Keep original files when possible. Do not crop away timestamps or sender details. Back up the material to a separate device or secure account. Prepare a chronological list of incidents so investigators can understand what happened without reconstructing the history from hundreds of screenshots.

Ask third-party recipients to preserve what they received and, if willing, provide a signed statement describing when and how they received it. Do not ask them to exaggerate or repeat information they did not personally observe.

3. Secure your phone and accounts

Review the app’s permissions and revoke access that is no longer necessary, particularly access to contacts, photos, camera, microphone, location, and storage. Check whether the app installed device-management settings or accessibility permissions. Change passwords for affected email, social-media, banking, and e-wallet accounts, and enable multi-factor authentication.

Uninstalling the app does not erase data the operator already obtained. Preserve the app information and evidence first, then decide whether removal is appropriate.

Tell contacts not to send money, click links, provide verification codes, or disclose further information to someone claiming to collect the debt. If a collector impersonates a court, police officer, lawyer, or government agency, verify the communication directly with the named institution using independently obtained contact details.

How to complain to the lending company

For a privacy complaint, identify the company’s data protection officer or official privacy contact from its privacy notice, website, app listing, loan documents, or SEC records. Send a dated written notice that:

Identifies you and the relevant account without sharing unnecessary information;
Describes each incident, including dates, numbers, accounts, and people contacted;
Identifies the personal data accessed, used, or disclosed;
States why the processing appears unauthorized, excessive, inaccurate, or unrelated to a legitimate collection purpose;
Requests that the harassment and unlawful processing stop;
Requests correction or deletion where legally appropriate, subject to lawful retention obligations;
Requests the identity of the responsible company and any collection agency or processor involved;
Asks for a written response; and
Attaches representative evidence while retaining the originals.

Use a delivery method that proves receipt. For an NPC complaint, the usual rule is that the company must first be informed in writing and must either fail to take timely or appropriate action or fail to respond within 15 calendar days from receipt.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm that only NPC action can prevent or mitigate, lack of a plain, speedy, or adequate remedy from the respondent, or conduct that is patently illegal. Explain and prove the urgent circumstances if you ask for a waiver; do not simply omit the company-notice step without explanation.

How to file an SEC complaint

Use the SEC iMessage SEC-Wide Ticketing System and direct the concern to the Financing and Lending Companies Department (FINLEND). You may also call 1-4732 (1-4SEC).

Include:

The lender’s complete corporate name, if known;
The app and platform names;
Its SEC registration and Certificate of Authority details, if available;
Your account or loan reference;
A concise incident chronology;
The collector’s numbers, accounts, and claimed identity;
Screenshots and messages showing the prohibited conduct;
Names and statements of third parties contacted;
Your loan documents, payments, and any disputed account computation; and
The specific action requested, such as investigation of unfair collection or verification of the company’s authority.

A trade name or app name may differ from the corporation operating it. Include every name appearing in the app store, privacy notice, loan contract, payment instructions, and collection messages.

If the provider is a bank, e-wallet operator, or another institution supervised by a regulator other than the SEC, its primary regulator may have a separate consumer-assistance process. Identify the entity named in the actual contract instead of assuming that every digital loan falls under the same regulator.

How to file a National Privacy Commission complaint

Use the NPC’s current complaint form and instructions on its official Filing a Complaint page. The NPC instructs complainants to complete the form, print it, have it notarized, and submit it in person, by courier, or as a scanned copy through the email address stated on the official filing page.

A formal complaint should generally:

Be written, signed, and properly verified;
Identify the complainant and respondent;
Clearly state the relevant facts and privacy violations;
Identify the requested relief;
Include supporting evidence;
Show compliance with the prior written-notice requirement or establish grounds for waiver; and
Include the required certification against forum shopping.

Use the NPC’s current form rather than drafting these formal portions from memory. Failure to attach evidence or comply with essential formal requirements can result in outright dismissal. NPC filing fees may apply under its current schedule, subject to applicable rules, including provisions for indigent data subjects.

If you later learn that the same or a similar claim has been filed in another court, tribunal, or quasi-judicial agency, the certification requirement generally obliges you to notify the NPC within five calendar days. Disclose related SEC, police, prosecutor, or court matters accurately; filing with several agencies is not a reason to conceal parallel proceedings.

The NPC decides privacy issues. It does not automatically decide every contractual, criminal, or SEC regulatory issue arising from the same collection activity.

Reporting threats, fraud, or possible cybercrime

The March 2026 joint government advisory identifies these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; telephone (632) 8723-0401 local 7491

For immediate danger, contact the nearest police station or emergency services instead of relying only on email.

Depending on the exact words, acts, intent, and evidence, threats, extortion, defamatory online publication, impersonation, or persistent harassment may implicate the Revised Penal Code, the Cybercrime Prevention Act of 2012, or another law. A threatening or offensive message is not automatically a particular crime; investigators and prosecutors must determine whether all legal elements are present.

Bring original devices and files when requested. Ask for a complaint, blotter, or reference number and record the officer, office, date, and documents received.

Does a collector have the right to threaten arrest?

No one may be imprisoned merely for debt under Article III, Section 20 of the 1987 Constitution. A private collector also cannot issue a warrant or order an arrest.

This does not mean that every dispute connected with a loan is necessarily civil. Separate conduct—such as fraud or issuing a check under circumstances covered by another law—must be assessed on its own facts. A collector’s generic threat of immediate arrest, however, is not proof that a criminal case exists. Verify any claimed complaint, subpoena, or warrant directly with the court or agency named on the document.

Do not ignore a genuine summons, subpoena, court order, or prosecutor’s notice. Seek legal assistance promptly and respond through the proper process.

Dealing with the loan while the complaint is pending

Separate the collection misconduct from the account balance:

Request a written statement showing principal, interest, fees, penalties, payments, and the remaining balance.
Review the lender’s identity and authority, the signed or accepted agreement, and mandatory disclosures.
Dispute inaccurate charges in writing and identify the exact entries challenged.
Pay only through a verified official channel and obtain a receipt.
Do not send money to a collector’s personal account merely because of a threat.
Do not provide passwords, one-time passwords, PINs, or remote access to your device.
If you negotiate, request written terms before paying and keep proof of every payment.

A privacy or harassment complaint does not by itself suspend contractual deadlines, remove valid charges, or stop a properly filed civil action. Conversely, a genuine unpaid balance does not excuse unlawful collection.

Common mistakes that weaken a complaint

Deleting or blocking messages before preserving them;
Submitting cropped screenshots with no date, sender, or context;
Naming only the app instead of identifying the operating company;
Filing an NPC complaint without first sending the required written notice and without explaining grounds for waiver;
Failing to attach the NPC verification, certification against forum shopping, or supporting evidence;
Combining every dispute into a vague accusation without dates or specific conduct;
Editing screenshots or forwarding them so many times that original metadata is lost;
Posting the collector’s personal information publicly in retaliation;
Making admissions, promises, or payments under pressure without first checking the account;
Ignoring a real court or prosecutor’s document because earlier messages were fake; and
Assuming an SEC or NPC complaint automatically cancels the loan or awards damages.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if you qualify, or another appropriate legal-aid provider promptly when:

There is a credible threat to life, safety, employment, or property;
Intimate images, identity documents, medical details, or children’s information were disclosed;
A collector has contacted your employer, clients, or a large number of people;
Money was obtained through extortion, impersonation, or a fraudulent payment channel;
You received a summons, subpoena, prosecutor’s notice, warrant, or court pleading;
The lender is seeking repossession, foreclosure, or another remedy affecting important property;
Several companies or unknown foreign operators are involved;
You need damages, an injunction, or another court remedy; or
You are unsure how parallel NPC, SEC, criminal, and civil proceedings may affect the certification against forum shopping or your legal strategy.

Frequently asked questions

Can a lending app contact everyone in my phonebook?

No. Unrestricted processing of a contact list is prohibited. For debt collection, the current government advisory states that lenders and financing companies may contact a guarantor, not unrelated phone contacts. A person listed merely as a character reference is not automatically a guarantor.

What if my relative agreed to be a reference?

A reference used for identification or verification is distinct from a guarantor who expressly consented to assume responsibility if the borrower defaults. Calling a person a “reference” does not by itself make that person liable for the loan.

Can I complain even if I really owe the money?

Yes. The existence of a debt does not legalize threats, public shaming, deception, abusive language, or unlawful processing of personal data. Be truthful about the debt and distinguish disputes about the balance from complaints about collection conduct.

Should I wait 15 days before reporting a threat?

Not where safety or possible criminal conduct requires immediate action. The 15-calendar-day rule concerns the ordinary prerequisite for a formal NPC privacy complaint. It does not prevent an immediate report to police, the NBI, DICT, or SEC. The NPC may also waive its prerequisite in qualifying serious or urgent cases.

Can I demand that the lender delete everything immediately?

You may exercise applicable data-subject rights, but deletion is not absolute. A company may retain data that remains necessary for the loan, legal claims, regulatory duties, or another lawful purpose. Data that is no longer necessary must be securely disposed of in accordance with applicable rules.

Will uninstalling the app stop the misuse?

It may stop future access through the app, especially after permissions are revoked, but it does not retrieve information already copied or disclosed. Preserve evidence and review permissions before uninstalling.

Can the SEC or NPC order compensation?

Available remedies depend on the agency’s legal authority, the procedure used, and the evidence. Do not assume that submitting an inquiry or regulatory report automatically produces compensation. Court proceedings may be necessary for some forms of damages or urgent injunctive relief.

Is a screenshot enough?

A screenshot can be important evidence, but a stronger submission includes the original message or file, complete conversation, sender details, date and time, URLs, witness material, loan documents, proof of company notice, and a clear chronology.

Official legal and reporting resources

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Rights, jurisdiction, and remedies depend on the lender’s identity, documents, communications, and other facts. Official sources and reporting channels were checked as of 2 September 2026.