Quick answer

You may report online lending app harassment to the Securities and Exchange Commission (SEC), privacy violations to the National Privacy Commission (NPC), and threats or possible crimes to law-enforcement authorities. If the lender is a bank, digital bank, electronic-money issuer, or another institution supervised by the Bangko Sentral ng Pilipinas (BSP), use its internal complaints process first and then escalate to the BSP.

A lender may privately and reasonably collect a valid debt. It may not use threats, insults, deception, public shaming, contact-list blasts, or disproportionate access to personal data. Harassment does not automatically cancel the loan, so address the debt and the unlawful collection conduct separately.

Conduct you can report

For lending and financing companies, SEC Memorandum Circular No. 18, series of 2019 prohibits the company and its third-party collection providers from engaging in unfair practices such as:

Threatening violence, criminal acts, or injury to a person, reputation, honor, or property.
Using obscene, insulting, or profane language.
Publicly disclosing—or threatening to disclose—the names or personal information of borrowers who allegedly refuse to pay.
Threatening legal or other action that cannot lawfully be taken.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting people in the borrower’s contact list who are not guarantors or co-makers, even if the borrower allowed the app to access the phone.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower gave express consent, evidenced in writing, electronically, or through a recording, that those hours are the only reasonable times for contact.

The time exception does not permit threats, humiliation, deception, or contact-list harassment.

Privacy violations may include:

Copying or using contacts, photos, messages, call logs, location data, or other information beyond what is necessary and disclosed.
Sending the borrower’s loan information, ID, photograph, edited image, or accusation to relatives, co-workers, employers, social-media contacts, or group chats.
Continuing to use permissions after their lawful purpose has ended.
Treating a character reference as responsible for the loan.
Using a character reference’s details for debt collection, marketing, cross-selling, or unrelated purposes.
Refusing to explain what information was collected, its source, the purpose of processing, and the persons to whom it was disclosed.

Under NPC Circular No. 2022-02, app permissions must be suitable, necessary, and not excessive. Unconstrained or disproportionate contact-list processing—particularly processing that causes harassment or unfair collection—is prohibited. A character reference may be contacted only for identity and information verification, not debt collection. A guarantor must have expressly agreed to answer for the debt, with separate consent.

Consent to install an app or grant a permission is not unlimited permission to shame the borrower or disclose the debt to everyone in the phone.

Preserve evidence before blocking or uninstalling the app

Secure the evidence while it is still available:

Take full screenshots showing the message, sender’s number or account, date, time, and surrounding conversation. Keep the original, uncropped files.
Export or back up text messages, emails, chat threads, call logs, voicemails, and social-media posts. Record the URLs and account names of public posts.
Capture the app-store page, developer name, privacy notice, requested permissions, app version, and download URL.
Save the loan agreement, promissory note, disclosure statement, amortization schedule, collection notices, account ledger, payment instructions, receipts, and disbursement records.
Identify the legal corporate name behind the app. It may differ from the app’s brand name. Look for it in the contract, disclosure statement, privacy notice, payment recipient, or app-store developer information.
Ask every relative, friend, colleague, or employer who received a message to preserve their own original screenshots and write a dated account of what happened. A witness affidavit may later be useful.
Maintain an incident log listing each call, message, disclosure, threat, and report made.
Store copies in a second secure location. Do not edit the originals or rely only on screenshots forwarded through messaging apps, which may remove metadata.

After preserving evidence, revoke unnecessary permissions for contacts, SMS, photos or storage, call logs, microphone, camera, and location. Change exposed passwords, enable multifactor authentication, and review linked financial accounts. Do not secretly record private calls without specific legal advice; the legality and admissibility of a recording can depend on how it was made.

Send a written privacy and harassment complaint to the lender

Write to the company’s customer-assistance unit and Data Protection Officer, not only to the individual collector. State:

Your name, account number, app name, and the legal company name, if known.
The dates, numbers, accounts, and names connected with the harassment.
The exact information accessed or disclosed and who received it.
That you dispute the unlawful collection conduct, without admitting any incorrect amount.
The action requested: stop contacting non-guarantors, remove public posts, restrict unnecessary processing, stop the collector, provide an itemized account statement, and preserve relevant records.
A request to identify the company, collection agency, Data Protection Officer, data collected, source of the data, lawful purpose, recipients, retention period, and measures taken.
A request for correction, blocking, removal, or deletion where legally applicable.

Ask for written acknowledgment and keep proof of delivery. Deletion is not absolute: the company may retain information that remains necessary for the loan contract, regulatory compliance, fraud prevention, or legal claims. It should nevertheless stop excessive or unlawful processing.

This written step is especially important for an NPC complaint. Under the NPC’s procedural rules, the complainant ordinarily must first inform the company or other responsible entity in writing and allow it to act. If it gives no response within 15 calendar days, or its action is untimely or inadequate, the complaint may proceed. The NPC may waive this requirement for good cause or a serious violation involving substantial risk of harm, including grave and irreparable damage, lack of an adequate remedy, or patently illegal conduct.

File a complaint with the SEC

Use the SEC route when the respondent is a lending company, financing company, its online lending platform, or its collection service provider.

The SEC lending and financing complaint page provides the current form and filing instructions. Complete the form accurately and attach:

A copy of a valid government-issued ID.
The loan agreement and disclosure statement.
Payment and disbursement records.
Screenshots, call logs, messages, public posts, and witness evidence.
Your written complaint to the company and its response, if any.
Documents connecting the app and collector to the respondent company.

Submit one complaint form for each respondent company. The SEC currently accepts the completed form by personal filing or email at flcd_complaints@sec.gov.ph. For email, use the prescribed subject format:

COMPLETE NAME_RESPONDENT COMPANY_SUBJECT OF COMPLAINT

You may also open a ticket through SEC iMessage. Keep the acknowledgment, ticket number, and the exact files submitted.

The SEC states that it sends the complaint to the company, which is given 10 days from receipt to provide an answer or comment. The SEC may request a reply, close a resolved matter, endorse issues to another regulator, or commence an administrative action when sufficient grounds exist.

The SEC cannot use this complaint process to cancel the debt, rewrite the payment terms, declare the contract void, or declare an interest rate invalid. Those questions may require negotiation or a proper court action.

File a privacy complaint with the NPC

Use the NPC route when the app or collector improperly accessed, used, retained, or disclosed personal data.

After completing the prior written-notice step—or explaining why an exception should apply—download the current NPC Complaint-Affidavit. The NPC requires a completed and notarized complaint form or other verified complaint, supporting evidence, witness affidavits where available, and a valid government-issued ID.

Follow the NPC filing instructions. A complaint may be filed personally, by registered mail, by courier, or by authorized electronic mail. The NPC website directs complainants using email to complaints@privacy.gov.ph. Electronic documents should be digitally signed and in PDF format where practicable.

The complaint must include verification and a certification against forum shopping. Disclose related SEC, BSP, police, prosecutor, court, or other proceedings accurately. If you later learn of another action involving the same or similar issues, the NPC form requires disclosure to the Commission within five calendar days. Never certify that no other case exists if you have already filed one.

Specify the relief you seek, such as stopping the processing, removing unlawfully disclosed data, enforcing your data-subject rights, damages where legally supported, or other appropriate orders. Relief is not automatic and will depend on the evidence and applicable law.

The NPC’s public guidance states that its Complaints and Investigation Division has 30 calendar days from receipt to give due course to or dismiss a complaint without prejudice. It estimates approximately 10 to 12 months for the process through final adjudication, although the actual period can vary. Where ongoing processing creates grave and irreparable harm, explain the urgency and ask whether an application for a temporary ban on processing is appropriate; additional proceedings and a bond may be required.

The governing statute is the Data Privacy Act of 2012. Whether particular conduct amounts to unauthorized processing, unauthorized disclosure, malicious disclosure, or another violation depends on the evidence and the legal elements of the offense. Filing a complaint does not itself establish criminal liability.

If the lender is supervised by the BSP

A loan inside an app is not necessarily an SEC-regulated lending-company loan. If the actual lender is a bank, digital bank, non-bank electronic-money issuer, or another BSP-supervised financial institution:

File a formal complaint with the institution’s Financial Consumer Protection Assistance Mechanism or customer-assistance unit.
If the response is unsatisfactory, escalate it through the BSP Consumer Assistance Mechanism.
Use the BSP Online Buddy on the BSP website or submit the prescribed complaint form to consumeraffairs@bsp.gov.ph.
Attach the original complaint to the institution, its response, your requested resolution, contact details, and supporting documents.

The Financial Products and Services Consumer Protection Act prohibits financial service providers from using abusive collection or debt-recovery practices and requires them to respect client privacy. It also makes providers responsible for their representatives and, in specified circumstances, solidarily liable with accredited third-party service providers.

Report threats and possible crimes separately

Do not wait for an administrative complaint if there is a credible threat of physical harm, stalking, extortion, account takeover, impersonation of police or court personnel, publication of intimate material, or another immediate danger.

Call 911 or go to the nearest police station for an immediate safety threat.
Use the NBI online complaint facility or approach the NBI Cybercrime Division or a regional or district office.
Consult the Department of Justice’s cybercrime incident reporting guidance for appropriate investigative channels.

Bring the original device if requested, but keep a backup first. Do not delete accounts, factory-reset the phone, or surrender the only copy of evidence without obtaining an inventory or acknowledgment. The investigating agency and prosecutor—not the collector—determine whether the facts support grave threats, coercion, cyber-enabled defamation, unlawful data processing, or another offense.

Ordinary nonpayment of a debt does not by itself permit imprisonment. The Constitution provides that no person shall be imprisoned for debt, but separate acts such as fraud may be investigated through lawful process. A collector cannot issue a genuine arrest warrant, subpoena, or court order.

Continue handling the legitimate loan safely

Harassment and the loan obligation are separate issues. While pursuing complaints:

Ask for an itemized statement showing principal, interest, fees, payments, and the amount claimed.
Review the disclosure statement and compare it with the amount demanded.
Dispute incorrect entries in writing.
Pay only through a verified official channel belonging to the legitimate lender. Be cautious if a collector demands payment to a personal account.
Keep every receipt and obtain written confirmation of settlement or account closure.
If payment is difficult, request restructuring in writing. Do not rely on an oral promise by an unidentified collector.
Do not take a new high-cost loan merely to silence a threatening collector.

Common mistakes to avoid

Uninstalling the app or deleting messages before preserving evidence.
Naming only the app brand and not identifying the corporate lender or collection agency.
Submitting cropped screenshots that hide the sender, date, or surrounding conversation.
Filing a complaint with no loan documents, valid ID, or proof connecting the collector to the company.
Treating a character reference as automatically liable for the debt.
Assuming that an SEC or NPC complaint cancels the loan.
Sending payment, IDs, or one-time passwords to an unverified collector.
Posting unredacted IDs, contracts, phone numbers, or relatives’ personal information publicly.
Making an inaccurate certification against forum shopping.
Ignoring genuine court documents. Verify them directly with the named court or through a lawyer rather than using the collector’s contact details.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

A case, subpoena, summons, or court order appears genuine.
The lender has published sensitive information or continues mass disclosure after written notice.
There are threats against you, your children, or your workplace.
Money or accounts were taken without authorization.
You are being pressured to sign a settlement, confession of judgment, waiver, or new loan agreement.
Several agencies or cases involve the same facts and the forum-shopping certification is uncertain.
You need damages, an injunction, a temporary processing ban, or criminal prosecution.
The company is unidentified, appears unlicensed, or operates from outside the Philippines.

Frequently asked questions

Can the app contact my family, employer, or friends?

Generally, it may not contact people found in your phone merely to collect or shame you. A person validly named as a guarantor or co-maker may be contacted about the obligation. A character reference is not a guarantor and may be contacted only for identity and information verification, subject to the NPC rules.

What if I agreed to contact access in the app?

That does not authorize unlimited processing. Permissions must remain necessary, proportionate, and tied to a disclosed lawful purpose. Under the SEC rule, consent does not make it lawful to contact non-guarantors or non-co-makers in the borrower’s contact list for collection.

Can I block the collector?

Yes, after preserving the messages, account details, and call records. Keep at least one reliable written channel open with the company’s official customer-assistance unit so legitimate account notices can still be received.

Should I stop paying because of the harassment?

Not solely for that reason. Harassment does not automatically extinguish the debt. Verify the lender, dispute incorrect charges, request a complete statement, and use only official payment channels while pursuing the complaint.

What if I never borrowed but received messages about another person’s loan?

Preserve the messages and inform the lender in writing that you are neither the borrower nor a guarantor or co-maker. Demand that it stop using your information and explain how it obtained your details. You may file your own NPC complaint because your personal data and privacy rights are involved.

What if the app appears unregistered?

Report it to the SEC and provide the app-store listing, developer information, website, advertisements, payment accounts, and loan documents. A company conducting a lending business generally requires SEC authority under the Lending Company Regulation Act of 2007. Do not assume that apparent lack of registration automatically decides the enforceability of a particular obligation.

Official sources

This article provides general legal information, not advice for a particular case. Outcomes depend on the contract, identity and regulatory status of the lender, exact communications, evidence, and other facts. Philippine laws, procedures, official forms, contacts, deadlines, and guidance were checked against official sources on 27 August 2026.