Quick answer

If an online lending app threatens, insults, publicly shames you, contacts people who are not your guarantors, or misuses your contacts, photos, or other personal data, document the conduct and report it through the correct channels:

Complain in writing to the lender or app operator and demand that the harassment and improper data use stop.
Report unfair collection practices to the Securities and Exchange Commission (SEC) through SEC iMessage.
File a privacy complaint with the National Privacy Commission (NPC) if personal data was accessed, disclosed, or used improperly. Ordinarily, you must first notify the company in writing and allow it 15 calendar days to respond.
Report threats, fraud, extortion, impersonation, or other possible crimes to the PNP, NBI, or DICT. Call 911 if anyone is in immediate danger.

A valid debt may still be collected through lawful means. Filing a complaint does not automatically cancel the loan, but owing money does not give a lender permission to harass, deceive, threaten, or publicly shame anyone.

What conduct may be unlawful?

The March 2026 joint advisory of the DICT, NPC, and SEC expressly warns online lending platforms against harassment, intimidation, public shaming, and unlawful use of personal data.

Conduct that should be documented and reported includes:

Threatening violence or harm to you, another person, your reputation, or property
Threatening an action that cannot legally be taken
Using obscene, insulting, abusive, or profane language
Pretending to be a police officer, court employee, lawyer, government official, or another person with authority
Sending a fabricated warrant, summons, court order, police report, or case number
Posting your name, photograph, identification document, debt, or alleged delinquency on social media or in group chats
Telling your employer, co-workers, neighbors, friends, or relatives about the debt to embarrass or pressure you
Contacting people taken from your phone, email, or social-media contact lists for collection
Using your photograph in a “wanted,” “scammer,” or similar shaming image
Communicating loan information known, or which should be known, to be false
Failing to disclose that the debt or amount is genuinely disputed when communicating information about it
Repeatedly contacting you before 6:00 a.m. or after 10:00 p.m., subject to the limited exceptions in SEC Memorandum Circular No. 18, Series of 2019
Requiring unnecessary app permissions or collecting information excessive for a legitimate loan-related purpose

A statement that the lender will pursue a genuine, legally available remedy is not automatically harassment. The problem arises when the threat is false, abusive, deceptive, disproportionate, or involves an action the collector cannot lawfully take.

The lender generally may not collect from your phone contacts

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, an app must not engage in unnecessary, excessive, or disproportionate processing of personal data.

The current government guidance is particularly clear:

An app may not freely copy, store, or use an entire contact list for collection.
Access must be limited to what is suitable, necessary, and proportionate for a specified legitimate purpose.
A character reference is not automatically a guarantor. A character reference is supplied for identification or verification.
A guarantor must have separately and expressly consented to assume responsibility for the loan.
For debt collection, the lender may contact the guarantor—not unrelated people found in the borrower’s contact list.
A borrower’s photograph must not be used to harass or embarrass the borrower.
Camera or photo-gallery access used for identity or payment verification should be disabled or revocable after that purpose is completed.

Tapping “Allow Contacts” or accepting broad app terms does not automatically validate harassment or unconstrained processing. Consent under the Data Privacy Act of 2012 must be freely given, specific, and informed.

However, withdrawing consent does not necessarily require the lender to erase every loan record. Some information may still be retained or processed when necessary to perform the contract, comply with law, or establish, exercise, or defend a legal claim. The processing must still be lawful, necessary, proportionate, and secure.

Preserve evidence before blocking or uninstalling the app

Do this as soon as possible:

Screenshot messages with the sender’s number or account name, complete text, date, and time visible.
Export chats where the messaging service permits it.
Save original emails, including headers when available.
Preserve call logs and existing voicemail messages.
Screenshot social-media posts, comments, profiles, group names, URLs, and timestamps.
Ask every person contacted by the collector to save the message and provide a signed affidavit or written statement if willing.
Capture the app’s name, developer, store page, version, privacy notice, terms, permissions, and customer-service details.
Screenshot the permissions shown in your phone settings.
Save the loan agreement, disclosure statement, repayment schedule, proof of disbursement, receipts, and payment history.
Keep copies of your written complaints and proof that the company received them.
Prepare a chronological incident log identifying what happened, when, through which account or number, and who witnessed it.
Back everything up to a secure account or device.

Do not edit or crop away information needed to establish authenticity. You may make redacted copies for ordinary sharing, but retain the originals.

Avoid secretly recording private calls without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Preserve written messages, call logs, and voicemails instead, or tell the caller that the call will be recorded and obtain clear consent.

Send the lender a written complaint and privacy demand

Use the lender’s published customer-assistance or Data Protection Officer contact. Identify the corporation behind the app from the loan agreement, disclosure statement, receipt, privacy notice, or app-store listing; the app’s brand name may differ from the legal entity.

Your message should state:

Your name and account or loan reference number
The specific conduct complained of
The dates, numbers, accounts, and collectors involved
Which personal data was accessed, used, or disclosed
The names or categories of third parties contacted
Whether you dispute the debt, amount, fees, or payment record
The action you want the company to take

You may demand that it:

Stop harassment and third-party disclosure
Stop contacting anyone who is not a valid guarantor
Preserve records relevant to the complaint
Identify the source, purpose, manner, and recipients of your personal data
Correct inaccurate loan or personal information
Restrict, block, or delete data unlawfully obtained, used for an unauthorized purpose, or no longer necessary
Confirm the identity and authority of the collection agency
Provide a written response and complaint reference number

Do not include passwords, PINs, one-time passwords, or unrelated identity documents. If identification is reasonably required, transmit it only through the company’s verified channel and redact information it does not need.

How to report the lender to the SEC

The SEC regulates lending and financing companies and receives complaints about unfair collection practices.

Go to SEC iMessage and select Open a New Ticket.
Sign in using an eSECURE account.
Select the service for the Financing and Lending Companies Department, then Complaints on Financing and Lending Companies.
Identify both the app and the corporation operating it.
Describe the events chronologically and identify the provisions or conduct involved.
Attach the loan documents, screenshots, witness messages, call logs, privacy notice, written complaint to the lender, and its response.
Save the ticket number and monitor the thread for requests for additional documents.

The SEC iMessage user guide explains account access, ticket creation, file uploads, replies, and status tracking. The SEC’s March 2026 advisory also lists hotline 1-4732 (1-4SEC).

Report the app even if you suspect that it is unlicensed. State why you cannot identify the legal operator and attach the app-store page, website, payment destination, phone numbers, advertisements, and any corporate name appearing in the loan documents.

How to file a privacy complaint with the NPC

First satisfy the 15-day rule

Under the 2021 NPC Rules of Procedure, as amended, a complaint ordinarily will not be given due course unless you prove that:

You informed the company or responsible entity in writing of the privacy violation; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days from receipt.

Attach the written notice, delivery confirmation, ticket acknowledgement, and response, if any.

The NPC may waive this requirement for proven good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or conduct that is patently illegal. Explain and document why immediate NPC action is necessary rather than merely omitting the prior notice.

Prepare the formal complaint

Use the NPC’s current Complaint-Affidavit form. It calls for:

Complainant and respondent information
The personal data processed
A clear, chronological narration
The alleged privacy violations
Proof of prior written notice or an explanation for not giving it
Documentary evidence and witness affidavits
The relief requested
Verification and certification against forum shopping
A valid government-issued ID

Complete the form accurately, sign it, and have it notarized. A representative generally needs a special power of attorney. Additional rules apply to minors, persons alleged to be incompetent, and complainants outside the Philippines.

Submit it through an authorized channel

The NPC’s current filing instructions allow submission:

In person
By courier
By registered mail
By scanning and emailing the notarized complaint to complaints@privacy.gov.ph

The current form identifies the NPC address as:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City 1103

Follow the current formatting and payment instructions on the NPC website. Keep the originals because the NPC may require them.

Filing fees

The published NPC Schedule of Fees and Charges lists a ₱500 complaint filing fee, plus the applicable legal-research fee. Claims for damages, motions, and applications for special relief may require additional fees or bonds.

Qualified indigent litigants may be exempt, but must satisfy the income and property conditions in the schedule and submit the required barangay certificate, affidavits, and tax declaration, if any. Confirm the assessment and payment instructions with the NPC when filing.

When immediate protection may be needed

Seek urgent help if the collector:

Threatens physical harm, kidnapping, sexual violence, or damage to property
Knows your home, workplace, or real-time location and threatens to go there
Demands money through threats to release private photographs or information
Impersonates law enforcement or sends a fabricated warrant
Takes over an account, steals an identity, or conducts unauthorized transactions
Continues mass disclosure of personal data despite written notice
Targets a child, older person, person with disability, or another particularly vulnerable person

For an immediate threat, call the national emergency hotline 911 or go to the nearest police station.

The March 2026 government advisory lists these reporting channels for other harassment, threats, fraud, or scams:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

An ordinary regulatory complaint is not a substitute for emergency or criminal reporting.

For serious, continuing privacy harm, the NPC has a special procedure for an application for a temporary ban on personal-data processing. It requires supporting evidence, judicial affidavits, and ordinarily a bond. Because this is formal interim relief, obtain legal assistance before or while applying.

If the provider is not regulated by the SEC

Check the actual lender named in the contract:

If it is a bank, digital bank, non-bank electronic-money issuer, pawnshop, money-service business, or another BSP-supervised institution, complain first through the institution’s consumer-assistance mechanism. If unresolved, use the BSP Consumer Assistance Mechanism or email the prescribed CIR form to consumeraffairs@bsp.gov.ph.
If it is a cooperative, the Cooperative Development Authority may be the relevant financial regulator.
The NPC may still have jurisdiction over improper personal-data processing, regardless of which financial regulator supervises the provider.

When uncertain, identify every corporate name in the documents and explain the uncertainty in your report instead of guessing.

Common mistakes that weaken a complaint

Uninstalling the app or deleting messages before preserving evidence
Naming only the app and not the corporation, collection agency, or payment recipient
Sending only selected screenshots without dates, numbers, or surrounding context
Making a purely verbal complaint and having no proof of receipt
Filing with the NPC without addressing the 15-day exhaustion requirement or requesting a justified waiver
Failing to notarize or verify the NPC complaint
Omitting evidence or the certification against forum shopping
Publicly reposting the harassment with unredacted IDs, addresses, account numbers, or contact details
Secretly recording private calls without considering the Anti-Wiretapping Act
Assuming the complaint automatically erases or suspends the debt
Paying a supposed “settlement” to a personal account without verifying the collector’s authority and obtaining an official receipt
Ignoring official notices because earlier messages were fake; independently verify any summons or court document with the issuing office

What reporting can—and cannot—do

The SEC may investigate the company and impose appropriate administrative measures, including fines or suspension or revocation of authority, depending on the applicable law, evidence, and proceedings. The NPC may issue compliance or enforcement orders, impose administrative fines, award appropriate relief, restrict data processing, or recommend criminal prosecution when warranted.

No particular outcome is automatic. Criminal liability, damages, deletion, reimbursement, or suspension of collection depends on the proven facts, the respondent’s defenses, and the relief legally available.

Under the Financial Products and Services Consumer Protection Act, consumers have rights to fair treatment, data protection, and timely complaint handling. Financial service providers are responsible for abusive collection practices by their personnel and may also be liable for conduct of authorized third-party service providers.

Claims under that Act generally prescribe five years after the financial transaction or discovery of deceit or material nondisclosure, subject to a ten-year maximum from the violation. Other privacy, civil, administrative, or criminal claims may have different periods. Report promptly and obtain legal advice rather than waiting for the last possible date.

Frequently asked questions

Can a lending app contact my family or employer?

Not merely to shame or pressure you. Current government guidance prohibits contacting people from your list for debt collection unless they are valid guarantors. A character reference does not become a guarantor simply because the borrower supplied a phone number.

What if I allowed contact access when installing the app?

That does not authorize unconstrained copying, disclosure, or harassment. App permissions and consent remain subject to necessity, proportionality, transparency, and lawful-purpose requirements.

Can I file even if the debt is real or overdue?

Yes. The validity of the debt and the legality of the collection method are separate issues. Continue addressing any legitimate balance while documenting and challenging abusive conduct.

Can I be jailed simply because I failed to pay a loan?

The Constitution provides that no person shall be imprisoned for debt. This does not protect a person from liability for a separate criminal act, if one is properly alleged and proved. A collector cannot lawfully fabricate criminal charges or a warrant to force payment.

I never borrowed, but the app contacted me. Can I complain?

Yes. If the app processed or disclosed your own phone number, name, messages, or other personal information improperly, you may be a data subject entitled to complain to the NPC. Tell the lender in writing that you are neither the borrower nor a guarantor and demand that the contact stop.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers, revoke unnecessary app permissions, strengthen account security, and report the numbers or accounts to the platform and authorities. Keep at least one safe written channel open if needed for legitimate account communication.

Does deleting the app erase the data it already collected?

No. Uninstalling generally stops future device access but does not necessarily delete information already copied to the lender’s systems or service providers. Make a written access, restriction, blocking, or deletion request and preserve proof.

Do I need a lawyer?

A lawyer is not required merely to submit an SEC ticket or use the NPC complaint form. Legal assistance is advisable when there are threats of physical harm, fabricated criminal accusations, identity theft, substantial financial loss, a claim for damages, multiple proceedings, or a request for urgent interim relief.

Official references

This article provides general legal information, not advice for a particular case. Applicable remedies and liability depend on the loan documents, communications, parties, evidence, and other facts. Official sources and procedures were checked as of 7 August 2026.