Quick answer

Report online lending app abuse to the agency that handles the specific violation:

Unfair collection, harassment, public shaming, or an unlicensed lending app: file with the Securities and Exchange Commission (SEC) through SEC iMessage. Select the Financing and Lending Companies Department and “Complaints on Financing and Lending Companies.”
Misuse or disclosure of contacts, photos, IDs, messages, or other personal data: first complain in writing to the lender or its data protection officer. If it does not take timely and appropriate action—or does not respond within 15 calendar days of receiving your complaint—file a formal complaint with the National Privacy Commission (NPC). The NPC may waive this waiting requirement for good cause or a serious violation presenting a risk of harm.
Threats, extortion, impersonation, fraud, or other possible crimes: report promptly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. Call 911 if anyone is in immediate danger.

Harassment is not made lawful merely because a loan is unpaid. Reporting abuse, however, does not automatically cancel a valid debt or prevent the lender from using lawful collection remedies.

What conduct should be reported?

The March 2026 joint advisory of the DICT, NPC, and SEC expressly prohibits unnecessary, unauthorized, excessive, or disproportionate processing of personal data by online lending platforms, whether recorded or unrecorded. It also prohibits contacting people in a borrower’s contact list for debt collection unless they are actual guarantors. Official DICT-NPC-SEC advisory

Report conduct such as:

Threatening violence, arrest, criminal prosecution, property damage, or another action the collector cannot legally take;
Using insults, obscenities, degrading language, or repeated intimidating messages;
Posting or threatening to post the borrower’s name, photograph, ID, loan details, or alleged delinquency on social media;
Sending “shame messages” to relatives, friends, employers, co-workers, customers, or other contacts;
Falsely claiming to be a lawyer, police officer, court employee, government official, or authorized process server;
Sending fabricated summonses, warrants, case numbers, barangay notices, or court documents;
Contacting people found in the phone, email, or social-media contact list who are not guarantors;
Treating a character reference as responsible for the debt even though that person never agreed to be a guarantor;
Using a borrower’s photograph, ID, contacts, location, messages, or files to embarrass or pressure payment;
Requiring access to data or device functions that are unnecessary for a legitimate loan-processing purpose;
Continuing to retain or use personal data after the lawful purpose has ended, without another lawful basis;
Refusing to identify the lending or financing company, collector, or lawful payment channel; or
Operating without the SEC authority required for a lending or financing company.

These practices may violate the SEC prohibition on unfair debt collection, the Data Privacy Act of 2012, or both.

What may an online lender lawfully access?

A lender may process information genuinely needed for lawful purposes such as identity verification, know-your-customer checks, credit evaluation, fraud prevention, payment verification, loan servicing, and lawful collection. Even then, processing must be transparent, necessary, proportionate, and supported by a lawful basis.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

App permissions should be requested only when the information becomes necessary.
The app should provide a just-in-time notice explaining how the information will be used.
Camera or photo-gallery access may be allowed for a specified legitimate purpose, such as identity or payment verification, but should be turned off or revocable after that purpose is fulfilled.
Contact-list access must be limited to what is necessary for the borrower to select a character reference or guarantor, or to derive proportionate metadata for a legitimate purpose.
Unconstrained harvesting or copying of the entire contact list is prohibited.
A character reference may be contacted only for identity and information verification—not for debt collection, marketing, cross-selling, or unrelated offers.
A character reference is not automatically a guarantor.
A guarantor must separately and expressly consent to that role.

Clicking “allow” does not give the app unlimited authority. Consent must be freely given, specific, and informed. Pre-ticked boxes, confusing screens, or designs that make consent easy to give but difficult to withdraw may undermine the validity of consent.

Act immediately, but preserve the evidence first

1. Address any immediate danger

If a message threatens imminent violence, identifies your home or workplace, demands money through intimidation, or indicates someone is being followed, call 911 or go to the nearest police station. The Unified 911 system connects callers to police, fire, medical, and rescue services.

Do not meet a collector alone or send money to a personal account merely because of a threat.

2. Preserve complete, original evidence

Before blocking numbers, deleting messages, or uninstalling the app, save:

Screenshots showing the entire message, sender’s number or profile, date, and time;
Original SMS, email, Messenger, Viber, WhatsApp, or other message threads;
Email headers and links, not just the visible message;
Call logs and any voicemails the collector left;
The app’s name, icon, developer, store listing, download link, version, and privacy policy;
Screenshots of every permission requested or granted;
The loan application, disclosure statement, contract, statement of account, payment schedule, and receipts;
Names and numbers used by collectors;
Posts, comments, group chats, or edited photographs used for public shaming;
Messages received by relatives, friends, employers, or other third parties;
Your written complaints to the lender and proof of delivery;
Ticket numbers and responses from the SEC, NPC, police, app store, or other agencies.

Ask each person contacted by the collector to preserve the message on their own device. Obtain a signed statement or affidavit if possible, describing when the message was received, the account or number that sent it, and what personal or loan information was disclosed.

Keep originals. Avoid cropping, adding annotations to the only copy, forwarding everything into one altered image, or relying solely on disappearing-message screenshots. Back up the files in a secure location and prepare a chronological incident list.

Do not secretly record a private call without legal advice and the authorization required by law. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties, and the Supreme Court has applied the rule even when the recorder participated in the conversation. Ramirez v. Court of Appeals

3. Secure your phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, camera, photos, microphone, location, storage, and SMS;
Check the phone’s privacy dashboard for recent access;
Change passwords for email, social media, banking, and e-wallet accounts if compromise is possible;
Enable multi-factor authentication;
Remove unknown device sessions and recovery details;
Ask your mobile provider about suspicious SIM activity; and
Uninstall the app if it is no longer needed and doing so will not destroy evidence you still require.

Revoking permission or uninstalling the app may stop future device access, but it does not erase information already copied to the lender’s systems.

Complain to the lender in writing

Send the complaint through the company’s official customer-assistance channel and, for a privacy issue, to its data protection officer. Use an address or channel shown in the contract, privacy notice, app, or official company website—not one supplied only by an unknown collector.

State:

Your name, account or loan reference, and safe contact details;
The app and corporate entity involved;
The collector’s name, number, or account, if known;
The dates, channels, and exact acts complained of;
The personal data accessed, used, or disclosed;
The third parties contacted and what they received;
Why the conduct is unauthorized, excessive, false, threatening, or unrelated to a lawful purpose;
The action you want; and
A request for written confirmation and a complaint reference number.

Depending on the facts, request that the company:

Stop threats, public shaming, and third-party collection messages;
Instruct its collectors and contractors to stop the conduct;
Identify the company and collection agency responsible;
Disclose what personal data it holds, where the data came from, how it was used, and to whom it was disclosed;
Correct inaccurate information;
Block, remove, or securely destroy data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary;
Preserve relevant logs, messages, call records, access records, and instructions to collectors; and
Provide its final written response.

A lender may still retain records needed to perform the loan contract, comply with law, or establish, exercise, or defend legal claims. A request to erase every loan record is therefore not automatically enforceable. The stronger request identifies the particular data or processing believed to be unlawful or excessive.

File an unfair-collection complaint with the SEC

For lending and financing companies, online lending platforms, and their collection agencies, submit the complaint through SEC iMessage. The system issues a ticket and allows status tracking. Select:

Financing and Lending Companies Department → Complaints on Financing and Lending Companies

The SEC’s March 2026 advisory also lists hotline 1-4732 (1-4SEC).

Attach:

Your chronological account of events;
The app and company identifiers;
The loan and payment documents;
Screenshots, call logs, messages, posts, and witness statements;
Details of everyone contacted;
Proof of your complaint to the company, if any; and
The specific resolution requested.

If the corporate identity is unclear, include every available clue: app-store developer, website domain, privacy-policy entity, payment recipient, bank or e-wallet account, customer-service address, collector’s number, SEC registration details displayed in the app, and screenshots of advertisements.

An SEC corporate registration by itself is not enough. A lending company must also have SEC authority to operate. Republic Act No. 9474

File a privacy complaint with the NPC

Observe the 15-day written-notice rule

The 2021 NPC Rules of Procedure generally require proof that:

You informed the lender, collector, or other respondent in writing of the privacy violation; and
It failed to take timely and appropriate action or did not respond within 15 calendar days after receiving the written notice.

Keep delivery evidence such as an email transmission and reply, courier record, platform ticket, or acknowledged letter.

The NPC may waive these requirements for good cause or a serious Data Privacy Act violation presenting a risk of harm—for example, grave and irreparable damage that requires NPC action, the absence of an adequate remedy from the respondent, or conduct that is patently illegal. Explain and prove the reason if you need the NPC to act before the 15-day period expires.

Use the current complaint form

Download the current NPC Complaint-Affidavit and questionnaire. Complete it accurately, attach a valid government-issued ID and all supporting evidence, and have it notarized.

The complaint should identify the respondent, describe the affected personal data, narrate the events chronologically, specify the privacy violations alleged, state the relief requested, and include verification and certification against forum shopping. If the company’s true name is unknown, provide facts and records that may lead to its identification.

The NPC accepts complaints personally, by registered mail, by courier, or by authorized email. Its current filing page directs complainants to scan and email the completed form to complaints@privacy.gov.ph. Confirm the latest instructions through the NPC filing page before submission.

The NPC’s published fee schedule lists a ₱500 complaint filing fee, with additional fees for certain claims or applications. Qualified indigent complainants may seek exemption subject to the documentary requirements in NPC Circular No. 2023-01.

Insufficient evidence or failure to comply with the required form can result in outright dismissal. Do not submit only a general statement that you were “harassed.” Connect each allegation to a dated message, call, disclosure, permission, witness, or document.

Report threats, fraud, or possible crimes

Regulatory complaints do not replace an urgent criminal report. The March 2026 government advisory provides these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Bring or attach the original messages, account identifiers, URLs, payment instructions, transaction records, and identification documents. Explain any fear of immediate harm. Let investigators determine whether the facts support grave threats, extortion, fraud, cyber libel, unauthorized data processing, or another offense; the proper charge depends on the exact words, conduct, intent, and evidence.

What if the provider is a bank or another BSP-supervised institution?

Most financing and lending companies and their online lending apps fall under the SEC. If the credit product is instead offered directly by a bank, non-bank electronic-money issuer, pawnshop, or another BSP-supervised institution, first use that institution’s free consumer-assistance mechanism.

If unresolved, escalate through the BSP Online Buddy or BSP Consumer Assistance channels. You may check whether an entity is BSP-supervised through the BSP Verifier. Privacy violations may still be reported separately to the NPC.

Common mistakes to avoid

Deleting the app, messages, or account before preserving evidence;
Posting your unredacted ID, loan agreement, phone number, or contact list publicly while asking for help;
Paying a collector’s personal bank or e-wallet account without verifying the company and obtaining an official receipt;
Assuming that reporting harassment automatically removes the debt;
Ignoring legitimate court papers because collectors previously sent fake ones;
Secretly recording private calls without checking the Anti-Wiretapping Act;
Naming only the app but not the company, developer, collector, payment recipient, or website;
Filing an NPC complaint without first giving written notice and allowing 15 calendar days, unless waiver grounds are properly alleged and supported;
Submitting cropped screenshots that omit the sender, date, time, or surrounding conversation;
Waiting until accounts, posts, numbers, or app listings disappear; and
Giving passwords, PINs, one-time passwords, or remote-device access to anyone claiming to investigate or settle the complaint.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

There is a credible threat to life, physical safety, home, family, or employment;
Intimate images, identity documents, medical information, or other sensitive data were published or threatened with publication;
Money was demanded through threats or impersonation;
The lender has sued, initiated foreclosure or repossession, or served genuine court papers;
Your identity, bank account, e-wallet, or SIM may have been compromised;
Many people were affected by the same data disclosure;
You need an urgent cease-and-desist order, temporary ban on processing, injunction, or damages;
You are being asked to sign a settlement, waiver, acknowledgment, restructuring agreement, or guaranty; or
A filing deadline or prescriptive period may be approaching.

The NPC rules adopt the statutory prescription periods applicable to penal violations of special laws. The exact period depends on the offense and facts, so do not assume that a privacy complaint can be filed indefinitely.

Frequently asked questions

Can a lender contact everyone in my phone?

No. Unbridled processing of a contact list is prohibited. For debt collection, the 2026 government advisory states that the lender may contact only a guarantor—not people harvested from the borrower’s contact list.

Can the lender collect from my character reference?

Not merely because that person was listed as a reference. A character reference is for verifying the borrower’s identity and information. The person is not a guarantor unless they separately and expressly consented to be one.

What if I allowed contact access when installing the app?

Permission does not authorize harassment, wholesale copying, public shaming, or disproportionate use. Processing must remain necessary, transparent, proportionate, and limited to a lawful purpose.

Can a collector tell my employer, relatives, or friends about my debt?

Using those people for collection or public shaming merely because their details appeared in a contact list is prohibited. A different conclusion may apply if a person is an actual guarantor or if disclosure is specifically required by lawful court or government process.

Does filing a complaint erase my loan?

No. The debt, charges, and payments must be assessed from the contract, disclosure statement, payment records, and applicable law. Harassment and the validity or amount of the debt are separate issues.

Can I be jailed simply because I cannot pay the loan?

The Constitution provides that no person shall be imprisoned for debt. A lender may nevertheless pursue lawful civil remedies, and separate conduct—such as fraud or an offense involving a check—may raise different legal issues. 1987 Constitution, Article III, Section 20

Can a collection agency blame the lending app, or vice versa?

Outsourcing does not remove the lender’s data-protection accountability. Identify and report both the lending or financing company and the collection agency or individual collector when the evidence supports their involvement.

Can a friend or relative who received the messages complain?

Yes, if that person’s own personal data was improperly obtained or processed, they may be a data subject entitled to exercise privacy rights and file their own NPC complaint. They can also provide evidence or an affidavit supporting the borrower’s SEC complaint.

Should I stop paying while the complaint is pending?

Do not assume that a complaint suspends payment obligations. Verify the balance and payment channel in writing, keep receipts, and obtain legal advice if the amount or contract is disputed. Never pay through an unverified personal account because of a threat.

Official sources

*This article provides general Philippine legal information, not legal

Quick answer

Online lenders may pursue a valid debt, but they may not harass, threaten, publicly shame, impersonate authorities, or misuse your personal data. Contacting people in your phone, email, or social-media contact lists for debt collection is prohibited unless the person is an actual guarantor who separately consented to that role. A character reference is not automatically a guarantor.

Report unfair collection practices by SEC-regulated lending or financing companies through the SEC iMessage portal. Report unlawful access, use, retention, or disclosure of personal data to the National Privacy Commission (NPC). For threats, fraud, extortion, or immediate danger, contact law enforcement without waiting for either administrative complaint.

A complaint does not automatically cancel a legitimate loan. Likewise, owing money does not take away your rights. The government’s March 2026 advisory applies these protections to entities offering or facilitating loans through online lending platforms, whether recorded or unrecorded. DICT-NPC-SEC Advisory on Online Lending Platforms

What conduct should be reported?

Unfair or abusive collection

SEC Memorandum Circular No. 18, series of 2019 prohibits unfair debt-collection practices by lending and financing companies. Report conduct such as:

Threatening violence, physical harm, property damage, reputational harm, or another criminal act.
Threatening arrest, imprisonment, prosecution, seizure, or another action that the collector has no legal power or basis to take.
Using insults, obscenities, profanity, or degrading language.
Pretending to be a police officer, lawyer, court employee, government official, or process server.
Sending false court notices, case numbers, warrants, subpoenas, or barangay documents.
Publishing or circulating the borrower’s name, photograph, loan information, identification documents, or alleged delinquency to shame the borrower.
Giving false information about the debt or concealing that the amount is disputed.
Using deceptive means to collect payment or obtain information.
Contacting the borrower at unreasonable hours. SEC rules generally identify contact before 6:00 a.m. or after 10:00 p.m. as unreasonable, subject to the limited exceptions stated in the circular.
Contacting people taken from the borrower’s contact list instead of communicating with the borrower or a properly consenting guarantor.

These restrictions also matter when collection is outsourced. A lender does not escape accountability simply because the messages came from a collection agency, employee, contractor, or third-party platform. See SEC Memorandum Circular No. 18, series of 2019.

Privacy violations

The Data Privacy Act requires personal-data processing to be transparent, for a legitimate purpose, and proportionate. It gives data subjects rights to information, access, correction, blocking or removal in appropriate cases, and indemnification for damage caused by unlawful processing. Republic Act No. 10173, sections 11 and 16

Possible violations include:

Requiring unnecessary access to contacts, messages, call logs, photos, files, location, camera, microphone, or social-media accounts.
Copying, storing, or harvesting an entire contact list.
Using contacts or photographs to threaten, embarrass, or pressure a borrower.
Telling relatives, friends, coworkers, employers, or strangers about a person’s loan merely because their details appeared in the borrower’s phone.
Posting identification cards, selfies, loan records, or altered “wanted” images.
Processing data for a purpose that was not properly disclosed.
Retaining personal data indefinitely after the legitimate purpose has ended.
Refusing to explain what data was collected, where it came from, who received it, and why it was disclosed.
Continuing to use unlawfully obtained or unnecessary data after a proper request to block or remove it.

An app may request limited access when genuinely necessary for a specified purpose—for example, temporary camera access for identity or payment verification. It must not turn that permission into unlimited access. Once the purpose is fulfilled and no other lawful basis applies, the app should turn off the permission or tell the user that it may be revoked. NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02

Character references are not guarantors

A character reference may be contacted only to verify the borrower’s identity or the truthfulness of information used in evaluating the application. The lender must explain how it obtained the reference’s details and give the reference an option to have the data removed.

A guarantor, by contrast, expressly agrees to answer for the borrower’s obligation in case of default. The lender must obtain the guarantor’s separate consent. Merely appearing in someone’s contacts—or being named as a reference—does not create a guaranty. NPC Circular No. 2022-02, sections 4 and 5

What to do immediately

1. Deal with any safety risk first

If a message contains a credible threat of immediate violence, someone is approaching your home or workplace, or you believe anyone is in danger, call the nationwide 911 emergency hotline or go to the nearest police station. Do not arrange a personal meeting with a threatening collector.

For non-immediate cyber threats, harassment, fraud, or scams, the March 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Contact details can change, so confirm them in the current joint government advisory before filing.

2. Preserve evidence before blocking or uninstalling

Save:

Complete screenshots showing the sender’s number, account name, date, time, and full message thread.
Original SMS, email, Messenger, Viber, WhatsApp, or other platform messages.
Email headers and links, not only the visible message.
Call logs and any voicemail left by the collector.
Screenshots of public posts, comments, group chats, or messages sent to other people.
The exact URL, username, group name, and date of every online post.
Screenshots of the app-store listing, developer name, app version, privacy notice, consent screen, and requested permissions.
The phone’s permission and privacy-dashboard history, if available.
The loan agreement, disclosure statement, repayment schedule, statement of account, receipts, and proof of previous payments.
The app’s corporate name, SEC registration number, Certificate of Authority number, business address, customer-service details, and Data Protection Officer information.
The names and numbers used by collection agents and the collection agency’s claimed identity.
Your written complaint to the lender and proof that it was delivered.
Ticket numbers and replies from the lender, SEC, NPC, app store, telco, police, or another agency.

Ask every relative, coworker, or friend who received a message to preserve it on their own device. If they are willing, obtain a signed statement describing when and how it was received.

Keep originals. Avoid cropping, highlighting, annotating, or editing the only copy. Back up evidence to a secure account or drive and prepare a simple chronological log.

Do not secretly record a private call without legal advice and the authorization required by law. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties, even when the recorder participated in the conversation. Preserve written messages, call logs, and voicemails instead. Republic Act No. 4200; Ramirez v. Court of Appeals

3. Secure your phone and accounts

After preserving the relevant screens:

Revoke the app’s access to contacts, photos, camera, microphone, location, storage, and other unnecessary permissions.
Change passwords for email, social media, banking, and e-wallet accounts if the app or its agents may have obtained access.
Enable multi-factor authentication.
Check for unfamiliar sessions, transactions, password-reset messages, and newly installed applications.
Block abusive numbers after saving their messages.
Uninstall the app if it is no longer necessary and doing so will not destroy evidence you still need.

Revoking permission stops or limits future device access; it does not necessarily delete information already copied by the lender.

Send the lender a written complaint and privacy request

Write to the company’s official customer-assistance channel and Data Protection Officer. Do not rely only on a phone call. Include:

Your name and account or loan reference, without sending passwords, PINs, one-time passwords, or unnecessary identification data.
The app’s name and the company or collection agency involved.
A dated, chronological account of what happened.
The exact numbers, profiles, or agents involved.
The personal data accessed or disclosed.
The people who were contacted and whether any was an actual guarantor.
Copies of representative evidence.
The action you want taken.

Depending on the facts, request that the company:

Stop threats, abusive language, public shaming, and third-party collection contacts.
Communicate only through a specified lawful channel.
Identify the lender, collection agency, responsible personnel, and Data Protection Officer.
Explain what personal data it holds, the source, purpose, retention period, and recipients.
Provide access to relevant personal data and correct inaccurate information.
Block or remove data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary.
Preserve collection logs, call records, access logs, consent records, and disclosure records while the dispute is pending.
Confirm its corrective action in writing.

Do not demand destruction of every loan record as though deletion were automatic. A lender may retain information that remains necessary to perform the contract, comply with law, or establish or defend a legal claim. The issue is whether each item and use has a valid basis and is proportionate.

How to report the lender to the SEC

For an online lending platform operated by a lending or financing company, submit a complaint through the SEC iMessage portal.

Choose the Financing and Lending Companies Department (FINLEND) and the service for Complaints on Financing and Lending Companies. The portal generates a ticket that can be tracked. The government’s March 2026 advisory also lists the SEC hotline as 1-4732 (1-4SEC).

Your complaint should identify:

The app and its operator.
The lending or financing company’s corporate name, if known.
Its SEC registration and Certificate of Authority details, if displayed.
The collection agency and individual agents, if known.
Each specific act complained of, with dates and times.
Whether the collector contacted non-guarantors, used threats, shamed you publicly, impersonated authorities, or disclosed false information.
Whether the app appears unregistered or conceals its operator.
The relief requested, such as an investigation and an order to stop the prohibited conduct.
All supporting evidence and your earlier complaint to the company, if any.

Report an apparently unlicensed operator too. Under the Lending Company Regulation Act, a lending company may not conduct business without SEC authority. Republic Act No. 9474

The SEC route addresses lending regulation and unfair collection. It does not replace an NPC complaint concerning your data or a police/NBI complaint concerning possible crimes.

How to file a privacy complaint with the NPC

First give written notice—unless an exception applies

As a general rule, the NPC will not give a complaint due course unless you show that:

You informed the lender, collection agency, or other respondent in writing of the privacy violation or personal-data breach; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your written notice.

Attach the notice, proof of receipt, and any response.

The NPC may waive these requirements for good cause or for a serious violation presenting a risk of harm—for example, grave and irreparable damage that requires NPC action, no plain and adequate remedy from the respondent, or conduct that is patently illegal. Waiver is discretionary, so explain and prove why immediate filing is necessary. NPC Circular No. 2021-01, Rule II, section 2

This 15-day requirement applies to the NPC’s exhaustion rule. It does not require you to postpone an emergency report, police complaint, evidence preservation, or SEC report.

Prepare the current form and attachments

Use the NPC’s current Complaint-Affidavit/Reklamong Salaysay form. Complete it accurately, attach your evidence and a valid government-issued ID, and have the complaint properly notarized.

The complaint must identify the respondent or provide facts that can lead to its identification. It should contain a clear chronology, the personal data involved, the allegedly unlawful processing or disclosure, supporting documents and witness affidavits, the relief sought, verification, and certification against forum shopping. Insufficient allegations or evidence may cause outright dismissal.

The NPC’s published options are personal filing, courier, or a scanned submission by email to complaints@privacy.gov.ph. Confirm the current address and instructions on the NPC filing page before sending or visiting. The current form identifies the NPC at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103.

The published fee schedule lists a ₱500 filing fee, with additional charges for certain claims or applications. Qualified indigent litigants may seek an exemption subject to documentary requirements. Check the current NPC schedule of fees and follow the NPC’s payment instructions.

Do not assume that a complaint can be filed indefinitely. The NPC rules adopt statutory prescription periods for penal violations of the Data Privacy Act, and the applicable period depends on the alleged offense. File promptly and seek legal advice if substantial time has passed.

What if the app is operated by a bank or another BSP-supervised institution?

Confirm who actually extended the loan. If the provider is a bank, non-bank electronic-money issuer, pawnshop, or another BSP-supervised institution—not an SEC-regulated lending or financing company—use the institution’s consumer-assistance mechanism first.

If unresolved, escalate through the BSP Online Buddy on the BSP consumer-assistance page or send the BSP’s complaint form to consumeraffairs@bsp.gov.ph. The BSP Verifier can help identify whether an institution is BSP-supervised.

Privacy issues may still be reported to the NPC, and threats or fraud may still be reported to law enforcement.

Common mistakes that weaken a complaint

Reporting only “harassment” without quoting or attaching the specific messages.
Naming only the app, not its corporate operator or collection agency.
Deleting the app and messages before preserving evidence.
Submitting isolated, cropped screenshots that do not show the sender, date, or surrounding conversation.
Omitting proof that non-guarantors were contacted.
Filing an NPC complaint without the prior written notice or without explaining why waiver is justified.
Sending unsupported accusations instead of a dated factual chronology.
Publishing the collector’s personal information, threats, or unverified allegations on social media in retaliation.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Paying a person who cannot verify the creditor, account, amount, and official payment channel.
Assuming that reporting harassment automatically cancels the debt.
Ignoring genuine court papers. Verify them directly with the court or through a lawyer; do not rely on a phone number supplied by the collector.

When legal help is urgent

Consult a lawyer, the Public Attorney’s Office if eligible, or another qualified legal-aid provider promptly when:

There is a credible threat of violence, extortion, stalking, or harm to family members.
Intimate images, identification documents, medical information, or other highly sensitive data were disclosed.
The lender contacted your employer or caused an actual employment or business loss.
Many people received the disclosure.
Money was taken through an unauthorized transaction.
The collector impersonated a court, police officer, lawyer, or government official.
You received authentic summons, a subpoena, or another court or prosecutor’s document.
You want damages, an urgent cease-and-desist order, or another remedy requiring formal proof.
The incident happened long ago and a filing deadline may be approaching.
You are being asked to sign a settlement, waiver, acknowledgment, restructuring agreement, or guaranty you do not understand.

Frequently asked questions

Can a lender contact everyone in my phone if I accepted the app’s terms?

No. General consent does not authorize unbridled, excessive, or disproportionate processing. The current government position is that people in the borrower’s contact list may not be contacted for debt collection unless they are named guarantors who separately consented. Deceptive interfaces, pre-ticked boxes, and designs that make consent easy but withdrawal difficult may also undermine valid consent.

Can a character reference be forced to pay?

Not merely because the person was listed as a reference. A guaranty is not presumed. The person must expressly agree to act as guarantor, and the lender must obtain separate consent consistent with the Civil Code and privacy rules.

May the lender still contact me directly?

Yes. A creditor may use reasonable and legally permissible methods to request payment, send account statements, negotiate repayment, or pursue a proper civil remedy. The prohibition concerns abusive, deceptive, disproportionate, or unlawful conduct.

Can I be imprisoned for an unpaid online loan?

The Constitution states that no person shall be imprisoned for debt. A creditor may still pursue lawful civil remedies. Separate conduct—such as an independently established criminal offense—must not be confused with simple inability or failure to pay. 1987 Constitution, Article III, section 20

Does revoking app permissions delete harvested contacts?

No. It can prevent further device access, but previously copied data may remain with the lender or its contractors. Send a written data-subject request asking what was collected, who received it, and whether unlawful or unnecessary data has been blocked or securely deleted.

Can a non-borrower complain?

Yes, if the lender processed that person’s data. A friend, relative, coworker, character reference, or other contact whose information was collected, used, or disclosed may exercise their own data-subject rights and, where appropriate, file their own NPC complaint.

Should I stop paying while the complaint is pending?

A harassment or privacy complaint does not by itself suspend or erase the contractual obligation. Verify the correct balance and official payment channel, keep receipts, and obtain advice before withholding payment or signing a restructuring agreement.

Should I report the app to Google, Apple, Facebook, or the messaging platform?

You may report the app, account, or post after preserving evidence. Platform reporting can help stop distribution, but it does not replace complaints to the SEC, NPC, BSP where applicable, or law enforcement.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rights, liability, jurisdiction, and remedies depend on the messages, loan documents, consent records, parties involved, and other evidence. Laws, procedures, forms, fees, addresses, and official channels were checked against primary government sources on 1 August 2026.