Quick answer

Report abusive collection practices to the Securities and Exchange Commission (SEC). Report unauthorized access, disclosure, contact-list use, public shaming, or other misuse of personal data to the National Privacy Commission (NPC). Threats, extortion, impersonation, fraud, account hacking, or immediate danger should also be reported to the PNP, NBI, or DICT.

You may use more than one route because harassment and privacy violations can overlap. Filing a complaint does not automatically erase a valid loan, but owing money does not give a lender or collector permission to threaten, shame, deceive, or misuse personal data.

If anyone is in immediate danger, call the nationwide Unified 911 Emergency Hotline.

Where to report

Problem	Where to report	Official channel
Abusive or unfair debt collection by a lending or financing company	SEC Financing and Lending Companies Department	SEC iMessage or hotline 1-4732 (1-4SEC)
Unauthorized collection, access, use, retention, or disclosure of personal data	National Privacy Commission	NPC complaint page and complaints@privacy.gov.ph
Threats, fraud, scams, account hacking, extortion, or other cyber-related conduct	DICT, NBI, or PNP Anti-Cybercrime Group	1326@dict.gov.ph; ccd@nbi.gov.ph; acg@pnp.gov.ph
Immediate threat to life, safety, or property	Emergency responders	911

These channels are confirmed in the government’s March 18, 2026 Joint Advisory on Online Lending Platforms.

What lenders and collectors are not allowed to do

The rules permit lawful collection of a legitimate debt. They do not permit abuse.

Under SEC Memorandum Circular No. 18, Series of 2019, Republic Act No. 11765, and the NPC’s loan-related privacy rules, prohibited or potentially unlawful conduct includes:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening an action that cannot legally be taken, such as claiming that a collector can personally order an arrest.
Using obscenities, insults, degrading language, intimidation, or coercion.
Pretending to be a police officer, lawyer, court employee, government agency, or another person.
Using false representations or deceptive means to collect a debt or obtain information.
Publishing or threatening to publish the borrower’s name, photograph, account details, or alleged debt to shame the borrower, except where a specific lawful disclosure applies.
Sending debt information to friends, relatives, co-workers, employers, or social-media contacts merely to pressure or embarrass the borrower.
Contacting a borrower at unreasonable or inconvenient hours—generally before 6:00 a.m. or after 10:00 p.m.—subject to the exceptions stated in the SEC circular.
Accessing or processing personal data that is unnecessary, excessive, or disproportionate to a legitimate loan-related purpose.
Continuing to use app permissions after their legitimate purpose has ended.

A collection agency or outsourced collector does not escape these restrictions. Lending and financing companies remain accountable for personal data under their control and for collection activities conducted through authorized service providers.

Can an online lending app contact people in your phone?

For debt collection, the government’s 2026 joint advisory states that lending companies, financing companies, and similar entities may contact only a guarantor—not everyone in the borrower’s contact list.

The rules distinguish among the following:

A character reference is provided for identity or information verification. A reference is not automatically a guarantor and should not be pressured to pay.
A guarantor expressly agrees to answer for the borrower’s obligation if the borrower defaults. Separate consent is required.
A co-borrower or co-maker may have liability based on a document that person actually signed or accepted. Merely appearing in someone’s contacts does not make a person a co-maker.
A friend, relative, employer, co-worker, or other contact does not become responsible for the debt simply because the app obtained that person’s number.

NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, prohibits unbridled contact-list processing. This includes processing that leads to harassment, results in unfair collection practices, or is used to collect from persons other than the borrower’s guarantors.

An app may have limited contact-list access to let the borrower select a reference or guarantor, or to derive proportionate metadata for a specified legitimate purpose. That limited access is not blanket authority to copy the phonebook or message everyone in it. Clicking “Allow contacts” does not legalize prohibited harassment.

Preserve evidence before blocking or uninstalling the app

Evidence is often lost when a message is deleted, an account disappears, or an app is uninstalled. Preserve what you can before changing settings.

Keep:

Full screenshots of threatening or shaming messages, including the sender’s number or account, date, and time.
Original SMS, email, Messenger, Viber, WhatsApp, or other message threads.
Call logs, voicemails, and dates and times of calls.
Screenshots of public posts, comments, group chats, or messages sent to other people, including the profile name and direct link where available.
Copies of messages received by relatives, friends, co-workers, employers, character references, or other contacts.
The app’s name, icon, developer, download-page link, privacy policy, permissions, website, and customer-service details.
The corporate name behind the app, SEC registration number, Certificate of Authority number, and collection agency name, if shown.
The loan agreement, disclosure statement, account ledger, repayment schedule, demand letters, receipts, and proof of payment.
Screenshots showing which phone permissions the app requested or held.
Your written complaint to the lender and proof that it was received.
Any response from the lender, its data protection officer, or its collection agent.

Keep original files whenever possible, not only edited or cropped copies. Back them up in a secure location and create a simple timeline listing each incident, sender, recipient, channel, and supporting file.

Ask affected contacts to preserve their own copies and provide a truthful written account. Do not publicly repost threats or expose other people’s personal information just to prove your case.

Secure your phone and accounts

After preserving evidence:

Revoke unnecessary access to contacts, camera, photos, storage, microphone, location, SMS, and call logs through your phone’s privacy settings.
Change passwords or PINs that may have been exposed or reused, starting with your email, mobile account, banking, and e-wallet accounts.
Enable multi-factor authentication where available.
Review bank and e-wallet activity for transactions you did not authorize.
Block abusive numbers or accounts after saving the evidence.
If you uninstall the app, retain screenshots, agreements, receipts, and account information first.
Do not send additional IDs, selfies, passwords, one-time PINs, or payments to an unverified person who contacts you through a threatening message.

Verify any settlement or payment instruction through the lender’s official channel. Pay only through a verified corporate payment route and obtain a receipt.

Send a written notice to the lender

A written complaint gives the company an opportunity to stop the conduct and creates evidence for the regulators. It is also normally required before the NPC will give a formal privacy complaint due course.

Send the notice to the company’s official customer-assistance channel and, if available, its data protection officer. Include:

Your name and enough account information to identify the loan without unnecessarily exposing more data.
The app and corporate names.
The dates, numbers, accounts, and names involved.
A factual description of the threats, disclosures, contact-list use, or other violations.
The names or roles of third parties contacted.
A demand to stop unlawful collection and processing.
A request to identify the collector and the source and recipients of the personal data.
A request to preserve relevant records, logs, instructions, and communications.
A request to delete or block unlawfully obtained data where legally appropriate.
A request for a written response and corrective action.

Deletion is not absolute. A lender may retain information when required by law or genuinely necessary to establish, exercise, or defend legal claims. It should not retain or use data indefinitely for an unspecified future purpose.

Send the notice by a channel that provides proof of delivery. Keep the sent email with its headers, ticket number, courier receipt, or acknowledged copy.

How to file the SEC complaint

The SEC handles complaints about financing and lending companies, including unfair collection practices by their online platforms and collection agents.

Go to SEC iMessage and choose Open a New Ticket.
Sign in using an eSECURE account.
Select Complaints on Financing and Lending Companies under the Financing and Lending Companies Department.
Identify both the app’s brand name and the corporate operator. Include the collector’s name if known.
Describe each incident separately, with dates, times, channels, recipients, and the conduct complained of.
Attach the loan documents, screenshots, call logs, third-party messages, payment records, and your timeline.
State whether the company appears to lack an SEC Certificate of Authority or whether its stated registration details cannot be verified.
Save the ticket number and monitor the ticket. Upload any requested documents through the same thread.

The SEC’s current iMessage user guide explains account creation, ticket submission, document upload, replies, and status tracking.

A bare statement that the app “harassed me” may be difficult to investigate. Describe exactly what was said or done, by whom, to whom, and when.

How to file the NPC privacy complaint

First, complete the written-notice requirement

Under the 2021 NPC Rules of Procedure, the complainant must generally show that:

The lender, collector, or other responsible entity was informed in writing of the privacy violation; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive this requirement for good cause or a serious violation, including situations involving grave and irreparable harm, the absence of a plain and adequate remedy, or conduct that is patently illegal. Explain and document the urgency if requesting a waiver. Do not assume that a waiver is automatic.

Prepare the formal complaint

Download the official Complaints-Assisted Form. The complaint should be complete, signed, verified, and notarized. Attach:

A valid government-issued ID.
The identity and available contact details of each respondent.
A clear narration of material facts.
Documentary evidence and witness affidavits, if available.
Your written notice to the respondent, proof of receipt, and its response or proof that 15 calendar days passed without a response.
The relief you are requesting.
A sworn certification against forum shopping.
A special power of attorney if an authorized representative is filing for an adult complainant.

The official form reminds complainants to submit one complaint form per respondent. If the app operator, collection agency, or other parties are separate entities, follow that instruction unless the NPC directs otherwise.

Submit and pay the required fee

The NPC’s filing page allows submission:

In person;
By courier; or
By emailing a legible scan to complaints@privacy.gov.ph.

The current NPC schedule lists a ₱500 filing fee, plus a legal research fee equal to 1% of the filing fee but not less than ₱10. Additional fees apply when claiming damages. Indigent complainants may qualify for an exemption if they satisfy the income and property requirements and submit the supporting documents listed in NPC Circular No. 2023-01.

Obtain an official assessment or payment instruction from the NPC before paying. Keep the official receipt or proof of authorized online payment.

The NPC may dismiss a complaint that lacks the required form, evidence, written-notice proof, or certification against forum shopping. Follow the form carefully and check the 2024 amendments to the NPC Rules of Procedure.

When to report to cybercrime authorities

Report promptly when the conduct involves:

A credible threat of physical harm.
Extortion or a demand accompanied by threats.
Hacking, account takeover, identity theft, or unauthorized transactions.
Fraudulent loan accounts or loans obtained using another person’s identity.
Impersonation of police officers, courts, lawyers, or government agencies.
Publication of altered, intimate, sexualized, or humiliating images.
Doxxing or disclosure of a home address that creates an immediate safety risk.
Malicious links, requests for one-time PINs, or instructions to install another app.

The March 2026 joint advisory provides these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (632) 8723-0401 local 7491

For an active or imminent emergency, call 911 or go to the nearest police station. Bring a copy of the evidence and keep the report, blotter, complaint, or reference number.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Filing only against the app’s brand name without identifying the corporate operator.
Submitting heavily cropped screenshots that omit the sender, date, or time.
Publicly arguing with collectors and revealing more personal information.
Assuming that app permission authorizes contact-list harassment.
Naming a character reference as a guarantor when that person never separately agreed.
Ignoring the NPC’s written-notice and 15-calendar-day requirements without explaining grounds for waiver.
Omitting the certification against forum shopping from an NPC complaint.
Paying a threatening stranger’s personal account without verifying the lender and payment channel.
Assuming that a complaint automatically cancels the principal, interest, or other disputed charges.
Ignoring an authentic court summons. Harassing messages are not court process, but a genuine summons requires timely attention.

Does reporting stop the debt?

Not by itself. A regulatory or criminal complaint addresses the collector’s conduct, privacy compliance, or possible offense. The underlying loan must be evaluated separately based on the agreement, disclosures, payments, interest, penalties, and applicable law.

You may dispute the amount, request a statement of account, seek a lawful restructuring arrangement, or challenge unauthorized charges without accepting harassment. Keep payment negotiations in writing and do not sign a waiver or settlement you do not understand.

The Constitution states that no person may be imprisoned merely for debt. A collector cannot issue an arrest warrant. Separate conduct—such as an independently alleged fraud or another offense—may be subject to criminal proceedings, but simple nonpayment is not itself authority for a collector to threaten immediate arrest. Never ignore genuine documents from a court or government agency; verify them directly with the issuing office.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly when:

A threat appears credible or identifies your home, workplace, or children.
Private or altered images have been circulated.
Your identity was used for a loan you did not obtain.
A bank, e-wallet, email, or social-media account was compromised.
You received a genuine subpoena, summons, complaint, or court order.
The collector is demanding that you sign a confession, waiver, deed, or settlement.
You want damages, emergency injunctive relief, or a cease-and-desist order.
Several lenders, collectors, or victims are involved and the correct respondents are unclear.
A filing deadline or possible prescriptive period may be approaching.

Frequently asked questions

Can I report the app even if my loan is overdue?

Yes. Delinquency permits lawful collection, not threats, public shaming, deception, or prohibited processing of personal data.

Can a lender message my family or employer?

Not merely because their numbers appeared in your phone. For debt collection based on a borrower’s contacts, the current joint advisory permits contact with a properly consenting guarantor. A person who actually signed as a co-borrower or co-maker may be contacted regarding that person’s own obligation.

Is a character reference required to pay?

No. A character reference is not automatically a guarantor. A guarantor must separately and expressly agree to assume that role.

Does allowing contact access make the messages legal?

No. Permission to access a device feature does not authorize excessive processing, harassment, public shaming, or contacting non-guarantors for collection.

Can a person who never borrowed file a privacy complaint?

Potentially, yes. A relative, friend, co-worker, or other person whose own name, number, messages, or other personal data were improperly processed may be an affected data subject. That person should preserve the message, notify the responsible company in writing, and follow the NPC complaint procedure.

Must I wait 15 days before reporting a threat?

Do not wait to report immediate danger, threats, fraud, or cybercrime to the police, NBI, DICT, or SEC. The 15-calendar-day rule concerns the usual exhaustion requirement for a formal NPC privacy complaint. The NPC may waive it in serious cases, but the request and supporting facts should be stated clearly.

What if the lender appears unregistered?

Report it to the SEC and include the app’s name, developer, website, corporate details, advertisements, payment accounts, and download link. The privacy rules can still apply to entities acting as lenders even when they lack the required SEC authority.

Can collectors have me arrested for an unpaid app loan?

A collector cannot order an arrest, and the Constitution prohibits imprisonment merely for debt. Any separate criminal allegation must proceed under the applicable law and proper legal process. Verify purported warrants, subpoenas, and court notices directly with the named government office.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any complaint’s outcome. Rights, liability, remedies, and deadlines depend on the documents and facts of each case. Official sources and procedures were checked as of August 6, 2026.