When an online lending app threatens to shame you, contacts your family or employer, posts your photo, uses abusive language, or claims that you will be arrested for an unpaid loan, preserve the evidence before blocking the collector. Philippine law allows legitimate debt collection, but it does not permit intimidation, public humiliation, indiscriminate access to your contacts, or threats of violence and unlawful arrest. Depending on what happened, you may report the lender or collection agency to the Securities and Exchange Commission (SEC), the National Privacy Commission (NPC), the Philippine National Police Anti-Cybercrime Group (PNP-ACG), or the National Bureau of Investigation Cybercrime Division (NBI-CCD).

When Online Lending App Collection Becomes Harassment

A lender may remind you about a due date, send a private demand letter, offer a payment arrangement, or file a lawful civil collection case. The existence of a valid debt does not, however, give the lender unlimited collection powers.

The SEC’s Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by lending and financing companies. A joint DICT-NPC-SEC advisory issued on March 18, 2026, further emphasized that these protections apply to entities offering or facilitating loans through online lending platforms, whether the platform is recorded with the SEC or not. (SEC Appointment System)

Collection activity	Generally lawful or reportable?
A private and respectful reminder about a past-due account	Generally lawful
A written demand showing the lender, loan amount, charges, and payment channel	Generally lawful
Offering restructuring or an installment plan	Generally lawful
Repeated calls before 6:00 a.m. or after 10:00 p.m.	Potentially prohibited as contact at unreasonable hours
Insults, obscenities, sexual remarks, or degrading messages	Reportable
Threatening physical harm, kidnapping, property damage, or harm to relatives	Potentially criminal
Claiming that police are “on the way” when no case or warrant exists	Deceptive and potentially reportable
Sending debt messages to everyone in the borrower’s contact list	Prohibited for debt collection
Posting the borrower’s photo, ID, or debt on social media	Potential privacy, SEC, civil, and criminal violation
Calling a character reference and demanding that the reference pay	Improper unless that person separately agreed to be a guarantor or co-maker
Filing a genuine civil collection case	Lawful, provided court processes are not misrepresented

The precise legal violation depends on the words used, the frequency and timing of the communications, the people contacted, the information disclosed, and whether the collector made a threat that could legally be carried out.

Philippine Laws That Protect Borrowers

SEC rules on unfair debt collection

Lending companies must be registered and must have authority to operate under the Lending Company Regulation Act of 2007, or Republic Act No. 9474. Financing companies are governed by the Financing Company Act of 1998, or Republic Act No. 8556.

SEC Memorandum Circular No. 18 prohibits collection methods involving threats of violence or criminal means, insults or profane language, deceptive representations, threats of action that cannot legally be taken, disclosure of borrower information to unauthorized persons, and other practices intended to shame or intimidate.

The Financial Products and Services Consumer Protection Act of 2022, or Republic Act No. 11765, also recognizes financial consumers’ rights to fair and respectful treatment, protection of personal information, appropriate disclosure, and effective complaint handling. (Lawphil)

Data Privacy Act and access to your contacts

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal data processing to have a lawful purpose and to be necessary, proportionate, transparent, and secure.

An app cannot treat permission to access a phone as permission to harvest, store, or message the entire contact list. The NPC’s loan-related data processing rules require online lenders to explain permissions clearly and limit data collection to what is genuinely necessary.

For debt collection, the March 2026 joint advisory states that lenders and collectors must not contact people in the borrower’s contact list except a person who was properly named and enrolled as a guarantor. A character reference is not automatically a guarantor. A guarantor must separately and expressly consent to assume that obligation. (National Privacy Commission)

Threats, coercion, libel, and cybercrime

Depending on the conduct, a collector may face possible liability under the Revised Penal Code, including:

Grave threats under Article 282, when a person threatens harm amounting to a crime against the borrower, the borrower’s honor or property, or the borrower’s family.
Grave coercion under Article 286, when violence, threats, or intimidation are used to force someone to do something against their will.
Unjust vexation, which may apply to conduct intended to annoy, distress, irritate, or torment when no more specific offense fits.
Libel, when defamatory accusations are publicly communicated under the circumstances required by Articles 353 and 355.

False and defamatory posts made through social media, messaging platforms, or other computer systems may also constitute cyber libel under the Cybercrime Prevention Act of 2012, or Republic Act No. 10175. In Disini v. Secretary of Justice, the Supreme Court upheld the law’s cyber-libel provision as applied to the original author of the defamatory online statement. Even when the debt itself is real, public disclosure may still violate privacy and fair collection rules. (Lawphil)

Civil liability for humiliation and invasion of privacy

Articles 19, 20, and 21 of the Civil Code of the Philippines recognize the duty to act with justice, give everyone their due, and observe honesty and good faith. A person who unlawfully or willfully causes damage may be liable for damages.

Article 26 separately protects a person’s dignity, privacy, peace of mind, family relations, and freedom from meddling or humiliation. These provisions may support a civil claim when collection conduct causes provable emotional, reputational, professional, or financial harm. (Lawphil)

What to Do Immediately After Receiving Threats

1. Prioritize physical safety

If the message contains a credible threat of physical harm, identifies your home or workplace, threatens your children or relatives, or suggests that someone is already nearby, contact the nearest police station or emergency services immediately.

Do not arrange an in-person meeting with an unidentified collector. Inform household members, building security, or workplace security when the threat includes a specific location.

2. Preserve evidence before blocking or uninstalling the app

Collect evidence while the messages, account, and app information remain accessible:

Take full-screen screenshots showing the sender, phone number or account name, date, time, and complete message.
Screen-record long conversations so the sequence and account profile are visible.
Save SMS messages, emails, call logs, voice messages, and recordings lawfully obtained.
Save the social media post, profile name, exact link, date, time, comments, and number of shares.
Ask relatives, colleagues, or contacts who received messages to save their own screenshots.
Keep the loan agreement, disclosure statement, payment schedule, account ledger, disbursement record, and receipts.
Capture the app-store listing, developer name, privacy policy, permissions page, and customer-service details.
Record the bank account, e-wallet number, QR code, or payment account being used by the collector.

Keep the original files unchanged. Store duplicate copies in cloud storage or another device. Avoid cropping the only copy; make separate redacted copies when sharing documents.

3. Identify the company behind the app

The app’s brand name may be different from the corporation that funded the loan. Look for the legal company name in:

The loan agreement
Disclosure statement
Privacy notice
App-store developer information
Disbursement transaction
Payment instructions
Collection message or demand letter

Check whether the company has an SEC Certificate of Authority and whether the platform is recognized through the SEC’s online services. An app’s presence in an app store does not, by itself, prove that the lender is authorized.

If the true operator cannot be identified, report every available identifier: app name, developer, website, phone numbers, email addresses, social media accounts, payment accounts, and screenshots.

4. Secure your phone and online accounts

After preserving evidence:

Revoke the app’s access to contacts, SMS, photos, camera, microphone, location, and storage.
Change passwords for email, social media, banking, and e-wallet accounts.
Enable two-factor authentication.
Review active login sessions and remove unfamiliar devices.
Warn affected contacts not to click links or send money.
Do not factory-reset the phone until important evidence has been copied.

5. Send one clear written notice

A short written notice creates a record and may satisfy the NPC requirement that the respondent first be informed of the privacy violation.

I am giving written notice that your collectors have engaged in the following conduct: [briefly describe the threats, third-party messages, public posts, or unauthorized use of data].

Stop threatening, insulting, publicly shaming, or contacting unauthorized third parties. Preserve all records relating to my account and the collection activity. Please provide the lender’s complete legal name, SEC registration and Certificate of Authority details, the collector’s identity, an itemized statement of account, and the contact details of your data protection officer.

This notice does not prevent lawful, private, and respectful communication regarding a properly documented account. Please confirm within 15 calendar days what corrective action has been taken.

Send the notice through an official email address, in-app support channel, or other traceable method. Keep the sent message and delivery confirmation.

6. Keep the harassment issue separate from the debt issue

Reporting harassment does not automatically cancel a valid loan. Ask for an itemized statement showing:

Principal actually received
Interest
Service or processing fees
Penalties
Previous payments
Remaining balance
Legal name of the creditor
Official payment channel

Do not send payment to a collector’s personal account without verifying that it is authorized. Keep every receipt and written settlement agreement.

How to Report an Online Lending App to the SEC

The SEC is the primary regulator for lending and financing companies and their online lending platforms.

Open the official SEC iMessage complaint portal.
Create or access your account.
Select the complaint channel for lending and financing concerns, commonly identified as FINLEND.
Enter the app name and the lender’s complete corporate name, if known.
Describe the events in chronological order.
State exactly what the collector said or did, who else was contacted, and what information was disclosed.
Upload the loan documents, screenshots, call logs, payment records, privacy notice, and your identification document when requested.
Save the electronic ticket number and use it to monitor the complaint.

The SEC’s current public advisory also lists hotline 1-4732 or 1-4SEC for lending and financing complaints. The iMessage system issues a ticket and provides a way to track the submission, but the total resolution period depends on whether the SEC needs clarification, a company response, or formal enforcement action.

An unregistered or unidentified platform should still be reported. State that the operator’s legal identity or authority could not be verified and attach the available technical and payment details.

How to File a Data Privacy Complaint with the NPC

Report the matter to the NPC when the app harvested contacts, messaged unauthorized third parties, disclosed the debt, posted personal information, misused an ID or photograph, or continued processing data without a proper purpose.

Step 1: Notify the lender or operator

NPC procedure generally requires the complainant to first notify the respondent in writing and allow it to address the privacy violation. If the respondent fails to take appropriate action or does not respond within 15 calendar days, the complaint may be filed.

The NPC may waive this requirement for good cause, including serious violations, irreparable harm, patently illegal acts, or circumstances in which prior notice would be impractical or dangerous. (National Privacy Commission)

Step 2: Prepare a verified complaint

Use the forms and instructions on the NPC’s official complaint filing page. A proper complaint generally includes:

Your full name, address, and contact information
The respondent’s name and available address or contact details
A clear chronological statement of facts
The personal data involved
The people who received or saw the disclosure
The relief or corrective action requested
Copies of your notice to the respondent and its response, if any
Screenshots, messages, posts, call records, documents, and witness statements
A valid identification document
Verification and certification against forum shopping
Notarization

Prepare a separate complaint form for each respondent when more than one company or entity is involved.

Step 3: Submit the complaint

A complaint may be submitted personally, by registered mail or courier, or as a scanned submission to complaints@privacy.gov.ph, subject to the NPC’s filing requirements.

The current NPC address is:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City

The NPC complaint page lists telephone (+63 2) 5322-1322, local 114 or 115, for complaint-related concerns. Check the current NPC filing instructions for any applicable fee and waiver rules. (National Privacy Commission)

After a complaint is given due course, the respondent may be directed to submit a verified comment within 15 calendar days. The case may then involve evaluation, conferences, mediation, further submissions, or investigation. There is no single guaranteed completion period.

Filing from outside the Philippines

A Filipino or foreign borrower abroad may file when the lender, data processing, platform, or harmful conduct has a sufficient Philippine connection. Under the amended NPC rules, a complaint notarized abroad must be properly authenticated through a Philippine embassy or consulate or apostillized by the competent foreign authority, as applicable.

Scanned filing may begin the process, but the NPC may require compliant originals or further verification.

How to Report Criminal Threats to the PNP or NBI

File a cybercrime or police report when the messages involve threats of violence, extortion, account hacking, identity theft, impersonation, doxxing, fake obscene images, defamatory public posts, or other potentially criminal conduct.

PNP Anti-Cybercrime Group

The March 2026 joint advisory lists these PNP-ACG reporting details:

Email: acg@pnp.gov.ph
Online complaint email: onlinecims.ocs@gmail.com
Telephone: (+63 2) 8723-0401, local 7491

NBI Cybercrime Division

The same advisory lists:

Email: ccd@nbi.gov.ph
Telephone: (+63 2) 8523-8231 to 38

The NBI’s investigative assistance procedure for computer-crime victims normally involves completing a complaint sheet, being interviewed, executing a sworn statement or affidavit, and submitting the device or digital evidence needed for examination. The initial intake service has no stated fee, although investigation, evidence preservation, identification of suspects, and referral for prosecution take additional time.

Bring or submit:

Government-issued ID
Printed and digital screenshots
Original phone containing the messages, when available
Call logs and voice recordings
Links and account identifiers
Loan documents and payment records
A chronological incident summary
Names and statements of other recipients or witnesses
Copies of previous SEC or NPC complaints, if already filed

Ask for the complaint, blotter, or reference number. An initial email is useful, but investigators may still require a personal interview, sworn affidavit, original device, or properly authenticated statement.

A barangay blotter may help document local incidents, but it does not replace reporting to the SEC, NPC, PNP, or NBI. Barangay conciliation may also be unsuitable when the collector is unidentified, located elsewhere, acting for a corporation, or making serious cyber-enabled threats.

Which Government Office Should Receive the Complaint?

Main problem	Office	Best evidence
Abusive or deceptive collection by a lending or financing company	SEC through FINLEND/iMessage	Loan agreement, collection messages, call logs, company and app details
Contact-list harvesting, unauthorized disclosures, or public posting of personal data	NPC	Privacy notice, app permissions, third-party messages, screenshots, prior written notice
Threats of violence, hacking, extortion, impersonation, doxxing, or cyber libel	PNP-ACG or NBI-CCD	Original device, screenshots, links, account identifiers, affidavit, witness records
Immediate physical danger	Nearest police station or emergency services	Threat messages, location details, suspect description, vehicle or account information
Damages to reputation, employment, business, or mental well-being	Appropriate civil court, depending on the claim and amount	Agency findings, medical or employment records, witness statements, proof of financial loss

The same incident may properly be reported to more than one office. For example, sending threats to the borrower’s employer may involve an SEC collection complaint, an NPC privacy complaint, and a criminal complaint if the message contains coercion, libel, or threats.

Evidence Checklist for a Strong Complaint

Organize the records by date. A simple folder structure can make the complaint easier to evaluate:

Identity and loan records
- ID
- Loan agreement
- Disclosure statement
- Proof of amount received
- Payment history
- Statement of account
Collector identification
- Phone numbers
- Email addresses
- Social media accounts
- App profile
- Company name
- Payment accounts
- Collector’s name or alias
Harassment evidence
- Screenshots
- Screen recordings
- Call logs
- Voice messages
- Public posts
- Threatening images
- Copies of messages sent to third parties
Privacy evidence
- App permissions
- Privacy notice
- Contact-list access request
- Names of people contacted
- Information disclosed to each person
Previous efforts to resolve the issue
- Written notice
- Customer-service tickets
- Responses from the lender
- SEC ticket
- NPC correspondence
- Police or NBI reference number
Proof of harm
- Employer memorandum
- Lost income or terminated contract
- Medical or psychological records
- Witness statements
- Costs incurred because of the incident

Use a short incident chronology rather than sending hundreds of unlabeled screenshots. For each item, state the date, sender, recipient, communication method, and why it is relevant.

Common Mistakes That Can Weaken a Complaint

Deleting the app too early

Uninstalling the app may remove account records, privacy notices, messages, and evidence of permissions. Preserve these first, then revoke access and uninstall when appropriate.

Posting unredacted screenshots publicly

Publicly posting the dispute can expose IDs, phone numbers, account details, and the personal information of relatives or witnesses. Keep full originals for authorities and use redacted copies elsewhere.

Paying an unknown personal account

Collectors sometimes direct payment to an account that cannot be linked to the creditor. Verify the official channel and obtain a written acknowledgment showing how the payment will be applied.

Assuming harassment automatically erases the loan

The lender’s misconduct and the borrower’s payment obligation are separate issues. A borrower may challenge unlawful charges, demand an accounting, report harassment, and still remain liable for a valid principal balance.

Ignoring actual court papers

A threatening text is not a court order. However, a genuine summons, subpoena, complaint, or notice from a court or prosecutor should not be ignored. Verify it through the issuing office rather than relying on the collector’s explanation.

Believing every threat of arrest

Article III, Section 20 of the 1987 Constitution provides that no person may be imprisoned merely for debt or nonpayment of a poll tax. Ordinary failure to pay a loan is generally a civil matter.

Separate criminal allegations may arise from different conduct, such as proven fraud or issuance of a bouncing check under applicable law, but a private collector cannot issue an arrest warrant or order the police to arrest someone simply because a payment is late. (Lawphil)

Frequently Asked Questions

Can an online lending app contact my family, friends, or employer?

For debt collection, the current DICT-NPC-SEC advisory says the lender or collector may contact a properly enrolled guarantor, not everyone in the borrower’s contact list. A character reference is not automatically a guarantor. Disclosing your debt, balance, ID, or photograph to relatives, friends, colleagues, or employers may violate SEC and privacy rules.

Can a lending app post my photo on Facebook because I did not pay?

Publicly posting a borrower’s photograph, ID, account information, or shaming notice may constitute an unfair collection practice and unlawful processing or disclosure of personal data. False defamatory statements may also raise libel or cyber-libel issues. Save the post, URL, profile, date, comments, and sharing information before reporting it.

Can I be jailed for an unpaid online loan?

Not merely because you cannot pay a debt. The Constitution prohibits imprisonment for debt. A lender may pursue lawful civil collection, but it cannot create a warrant or have you arrested simply for a missed payment. A separate criminal case would require separate facts and proper legal proceedings.

Does filing a complaint cancel my loan?

No. The agency complaint addresses harassment, privacy violations, unlawful business practices, or criminal conduct. Any valid loan balance remains a separate issue unless it is paid, settled, invalidated, or otherwise resolved through lawful processes.

Is my character reference required to pay?

No, not merely because that person was listed as a reference. Liability as a guarantor or co-maker requires a separate legal undertaking and consent. A collector should not misrepresent a reference as someone automatically responsible for the debt.

What if the online loan is not mine?

Notify the lender in writing that you dispute the account and request the application records, identity-verification records, disbursement destination, device or account information, and source of the personal data. Do not pay simply to stop the messages. Preserve the evidence and report possible identity theft or unauthorized processing to the NPC, PNP-ACG, or NBI.

Should I block the collector’s number?

Preserve the messages, profile, call history, and voice recordings first. After securing the evidence, blocking may reduce further distress. Keep at least one safe written channel open if you still need an account statement or formal response, but you do not have to engage with insults or threats.

What if the app is unregistered or has disappeared from the app store?

Report it anyway. Provide the app name, screenshots, developer name, website, phone numbers, payment accounts, privacy policy, installation records, and any file or link associated with the app. SEC, NPC, and cybercrime investigators may use these details to identify the operator.

Can I report the harassment while living abroad?

Yes, when the lender, platform, data processing, or conduct is connected to the Philippines. Electronic submissions may be accepted initially, but a sworn complaint executed abroad may require Philippine consular authentication or an apostille. Police or NBI investigators may also request a formal affidavit and additional identity verification.

Key Takeaways

Legitimate lenders may collect a debt, but they may not use threats, insults, public shaming, deception, or unauthorized disclosure of personal information.
For debt collection, an app must not contact everyone in your phonebook; only a properly enrolled guarantor may be contacted.
Preserve screenshots, call logs, app permissions, loan records, payment details, public posts, and messages received by third parties before blocking or uninstalling the app.
Report unfair collection practices to the SEC through the FINLEND channel on iMessage.
Report contact harvesting, unauthorized disclosures, and misuse of personal data to the NPC.
Report violence, extortion, hacking, doxxing, impersonation, and other potentially criminal conduct to the PNP-ACG or NBI Cybercrime Division.
Send the lender a written privacy notice and preserve proof of delivery; NPC procedure generally allows 15 calendar days for a response unless the requirement is waived.
Harassment does not automatically extinguish a valid debt, but ordinary nonpayment alone does not permit arrest or imprisonment.