Quick answer

An online lender may demand payment of a valid debt, send reasonable reminders, negotiate repayment, and pursue lawful collection or court remedies. It may not use threats, insults, deception, public shaming, or unlawful access to personal data to force payment.

In particular, an online lending platform generally cannot:

Broadcast your debt to relatives, friends, co-workers, employers, or social-media contacts;
Contact people found in your phonebook for debt collection merely because the app obtained access to it;
Treat a character reference as a guarantor;
Use your photograph, identification, contacts, messages, or other data to embarrass or intimidate you;
Threaten arrest, criminal prosecution, property seizure, or another action it has no legal basis or authority to take; or
Use obscene, insulting, deceptive, or threatening communications.

These acts may violate the Data Privacy Act, National Privacy Commission (NPC) rules, Securities and Exchange Commission (SEC) debt-collection regulations, and—depending on the exact conduct—criminal or civil laws. Paying late does not surrender your privacy or dignity. At the same time, harassment does not automatically cancel a legitimate loan.

What Philippine law protects

The Data Privacy Act

Under the Data Privacy Act of 2012, personal information must be processed for a lawful, declared purpose and in a manner that is transparent, legitimate, proportionate, and secure. Consent, when relied upon, must be freely given, specific, and informed. Clicking “allow” does not give a lender unlimited authority to use everything on a phone for any purpose.

Borrowers and other affected individuals have enforceable rights, including the rights to be informed, access their data, object to certain processing, correct inaccurate information, and seek erasure or blocking when legally justified. They may also complain to the NPC and claim damages in an appropriate case.

Not every use of borrower information is unlawful. A lender may process information genuinely necessary to evaluate an application, verify identity, administer the loan, collect a lawful obligation, prevent fraud, comply with law, or establish and defend legal claims. The decisive questions include what data was collected, why it was needed, what the privacy notice said, who received it, and whether the use was necessary and proportionate.

Special privacy rules for online loans

NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, specifically regulates personal-data processing in loan-related transactions.

The current rules prohibit unnecessary app permissions and excessive or uncontrolled processing of contact lists. Access to a camera or photo gallery may be justified for a specified purpose such as identity verification, know-your-customer checks, fraud prevention, or payment verification, but it must be limited to that stage. A borrower’s photograph cannot be used to harass or embarrass the borrower.

An app may provide limited contact-list access so the borrower can select a character reference or guarantor, or may derive proportionate metadata where necessary for a specified legitimate purpose. It cannot freely harvest and use the entire phonebook for collection.

The government’s March 18, 2026 joint advisory on online lending platforms confirms that:

Unnecessary, unauthorized, excessive, or disproportionate processing is prohibited;
Contacting people in the borrower’s contact list other than guarantors for debt collection is prohibited;
A guarantor must have expressly consented to assume responsibility for the loan;
Character references are for identification or verification, not collection;
Platforms must retain personal data only as long as necessary for a lawful purpose, legal claims, or a legally required period, and must then dispose of it securely; and
Once an app permission has served its purpose, the platform should turn it off or prompt the user to revoke it.

SEC rules against unfair collection

SEC Memorandum Circular No. 18, Series of 2019 applies to financing and lending companies and their collection agents. Prohibited conduct includes:

Using or threatening violence or other criminal means to harm a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Disclosing or publishing borrowers’ names and personal information to shame them, subject to narrow lawful exceptions;
Communicating false loan information or failing to state that a debt is disputed where the rules require that qualification;
Using false representations or deceptive collection methods; and
Contacting borrowers at unreasonable hours—before 6:00 a.m. or after 10:00 p.m.—unless a stated exception in the circular applies, such as express permission or the specified degree of delinquency.

A lender remains responsible for collection done through its employees, outsourced collectors, agents, or service providers.

Character references are not automatically liable

A character reference confirms identity or helps with verification. That person does not become legally responsible for the debt simply because the borrower entered their name or number.

A guarantor is different. Under the current NPC rules, the person must separately and expressly consent to undertake responsibility for the loan. Whether a valid guaranty exists—and its scope—depends on the actual agreement and applicable law.

A collector therefore cannot legitimately tell a mere reference, friend, relative, or employer that they must pay merely because their details appeared in the borrower’s contacts. If the lender claims someone is a guarantor, ask for the document showing that person’s consent and undertaking.

Harassment does not erase the debt

Illegal collection conduct and the validity of a loan are separate questions. A borrower may complain about harassment while still disputing, negotiating, or paying the amount lawfully due.

Article III, Section 20 of the 1987 Constitution provides that no person shall be imprisoned for debt. Ordinary inability or failure to pay a civil loan is not, by itself, a ground for arrest. However, distinct conduct—such as fraud or the issuance of a bouncing check under circumstances covered by law—may raise separate issues. A collector cannot truthfully promise arrest or criminal charges without a factual and legal basis.

A lender may file a civil case. Do not ignore genuine court papers. Verify suspicious documents directly with the court named in them; a collection message, demand letter, or image made to resemble a warrant is not itself a court order.

What to do immediately

1. Preserve evidence before blocking or uninstalling

Save the original material where possible:

Full screenshots showing the sender, number or account, date, time, and complete message;
Screen recordings of message threads, app pages, permissions, privacy notices, and collection posts;
Call logs and any lawfully obtained recordings;
Voicemails, emails, social-media posts, comments, and profile links;
The app’s exact name, developer, download page, package identifier, and version;
Loan agreement, disclosure statement, promissory note, repayment schedule, receipts, and account ledger;
Names or aliases used by collectors and the company they claim to represent;
Statements from contacts who received messages, together with screenshots from their own devices; and
Copies of every complaint, demand, response, ticket number, and delivery receipt.

Keep unedited originals and create backups. Do not crop out identifying details. Prepare a chronological log stating what happened, when, through which channel, and who witnessed it.

2. Reduce further access

After preserving evidence:

Review the app’s permissions and revoke access that is no longer necessary, especially contacts, camera, photos, microphone, location, files, and call logs;
Change passwords if credentials may have been exposed;
Enable multi-factor authentication;
Review active sessions on email and social-media accounts;
Warn affected contacts not to engage, send money, open links, or provide codes; and
Report abusive accounts or posts to the relevant platform.

Revoking a permission does not necessarily delete information already copied. Send a written privacy request to the company as well.

3. Send a written notice to the lender

Address the company and its data protection officer, if identified in the privacy notice. State:

The exact app and loan account;
The challenged messages, disclosures, permissions, or contacts;
That you object to harassment and any unnecessary or disproportionate processing;
That the debt is disputed, if applicable, identifying the disputed amount or charge;
That collection communications should be directed only to you or your authorized representative;
Your request to stop contacting non-guarantor third parties;
Your request for access to the personal data held about you, its sources, purposes, recipients, and retention basis;
Your request to correct inaccurate information and erase or block unlawfully processed data, subject to legitimate retention duties; and
A request to preserve relevant records for regulatory or legal proceedings.

Keep proof that the company received the notice. Avoid unnecessary admissions about disputed amounts.

4. Verify the lender and calculate the account

Ask for the lender’s full corporate name, SEC registration details, Certificate of Authority, office address, itemized statement, and basis for every interest charge, fee, and penalty.

Do not send payment to a personal account merely because a collector demands it. Confirm official payment channels with the company. If settling, require written terms and retain proof of payment and any certificate of full payment or account closure.

Where to complain

The same incident may fall within more than one agency’s authority. Clearly describe which part of the complaint belongs to each agency.

Securities and Exchange Commission

Report unfair collection by lending or financing companies to the SEC Financing and Lending Companies Department through SEC iMessage. The government’s 2026 advisory also identifies the SEC hotline 1-4732 (1-4SEC).

The SEC’s complaint guidance instructs complainants to complete the prescribed form, attach supporting evidence and a government-issued ID, and file one complaint form for each respondent company.

National Privacy Commission

For unlawful collection, access, disclosure, retention, or other processing of personal data, first notify the lender or concerned entity in writing and give it an opportunity to act. Under the 2021 NPC Rules of Procedure, as amended, an NPC complaint ordinarily requires proof that the entity failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable harm, no adequate remedy, or patently illegal conduct. Do not assume a waiver; explain and prove why it is needed.

A formal complaint generally must be written, signed, verified, and accompanied by evidence, correspondence with the respondent, the relief requested, and a sworn certification against forum shopping. Filing fees may apply, subject to the rules on exemptions or waiver. The NPC website provides a complaints-assisted form and currently directs complaints to complaints@privacy.gov.ph. Check the NPC website and current rules before filing.

Threats, fraud, impersonation, or immediate danger

For cyber-enabled threats, fraud, or scams, the March 2026 government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

If there is an immediate threat to life or physical safety, contact emergency services or the nearest police station without waiting for an administrative complaint.

Depending on the evidence, threats, coercion, defamation, identity misuse, or computer-enabled offenses may also implicate the Revised Penal Code or the Cybercrime Prevention Act. Criminal liability is fact-specific; let investigators or counsel assess the correct offense instead of selecting charges from labels alone.

Common mistakes to avoid

Deleting the app or messages before preserving evidence;
Posting your full loan records, IDs, phone number, or collector messages publicly without redacting sensitive data;
Assuming every unpleasant reminder is legally actionable harassment;
Assuming app consent authorizes unlimited access or disclosure;
Assuming a character reference is a guarantor;
Paying an unverified collector or personal e-wallet account;
Ignoring a legitimate court summons because earlier messages were fake;
Filing a bare complaint without dates, documents, respondent identity, or proof of prior written notice;
Filing identical cases in several forums without disclosing them where a certification against forum shopping is required; and
Believing that a regulatory complaint automatically suspends payment, cancels the loan, or produces damages.

When legal help is urgent

Consult a Philippine lawyer promptly if:

A collector threatens violence, visits your home aggressively, stalks you, or threatens family members;
Intimate images, altered photographs, IDs, or private records have been published or threatened with publication;
Your employer, clients, school, or large groups of contacts have been messaged;
The lender claims you signed a guaranty, promissory note, settlement, or waiver that you do not recognize;
You receive authentic court papers, a subpoena, or notice from a regulator;
Money is being demanded for a loan you never obtained;
Your identity or accounts may have been compromised;
You are being pressured to sign a settlement you do not understand; or
Significant financial, employment, safety, or reputational harm has already occurred.

The Public Attorney’s Office may be an option for persons who satisfy its eligibility and merit requirements. A private lawyer can also assess injunctions, damages, criminal complaints, debt defenses, or settlement terms based on the actual documents.

Frequently asked questions

Can a lending app message everyone in my contacts?

Generally, no. Current NPC guidance prohibits contacting people from the borrower’s contact list for debt collection unless they are guarantors who expressly consented to that role. Limited access allowing the borrower to select references or guarantors is not permission to use the entire phonebook for pressure or public shaming.

Can the lender call my employer or family?

Not merely to embarrass you or expose the debt. The legality may differ if the person is a duly consenting guarantor, an authorized representative, or must be contacted for a specific lawful reason. The lender must still observe privacy and fair-collection rules.

Is a reference required to pay?

No. A character reference is not automatically a guarantor or co-borrower. Ask the lender to produce the agreement allegedly creating liability.

Can collectors threaten to have me arrested?

They cannot lawfully use false threats. Nonpayment of an ordinary debt does not itself result in imprisonment. Separate allegedly criminal conduct must have its own facts, legal elements, and proper process.

Should I block the collector?

Preserve complete evidence first. You may then block abusive channels, but keep at least one controlled written channel if you need account statements, settlement communications, or proof of continuing conduct.

Can I demand deletion of all my information?

You may request erasure or blocking of unlawfully processed or no-longer-necessary data. The right is not absolute: a lender may retain information required by law or reasonably necessary for the contract, accounting, regulatory compliance, or legal claims. Ask it to identify the specific legal and retention basis.

Does filing a complaint stop interest or collection?

Not automatically. Continue to address any undisputed lawful obligation and request an itemized statement or written restructuring proposal. A regulator, court, settlement, or applicable rule must supply any suspension or other relief.

Can I recover damages?

The Data Privacy Act recognizes a right to indemnity for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information. Recovery depends on proof, causation, the proper proceeding, and the relief ultimately awarded; it is not automatic upon filing a complaint.

Official references

This article provides general legal information, not advice for a specific case. Outcomes depend on the loan documents, communications, consent records, parties, and other evidence. Official sources and procedures were checked as of July 27, 2026.