Quick answer

An online lender may demand payment, send lawful reminders, negotiate, or file a civil case. It may not use threats, violence, insults, false legal claims, public shaming, or improper disclosure of your debt and personal data to relatives, coworkers, employers, social-media contacts, or other third parties.

If harassment is happening now:

Preserve the evidence before blocking, deleting, or uninstalling anything.
Secure your phone and revoke unnecessary app permissions.
Send the lender a written demand to stop the harassment and communicate only through an official channel.
Complain to the correct regulator: usually the Securities and Exchange Commission (SEC) for a lending or financing company, the National Privacy Commission (NPC) for misuse or disclosure of personal data, or the Bangko Sentral ng Pilipinas (BSP) if the lender is a BSP-supervised institution.
Report immediate threats, extortion, impersonation, or other possible crimes to the police or cybercrime authorities.

Harassment does not erase a valid loan. You should separately verify the amount due and propose a realistic payment arrangement if you owe the debt. But owing money does not surrender your dignity, privacy, or legal rights.

What lenders may—and may not—do

A legitimate creditor may contact you privately about an overdue account, identify itself and its authorized collection agent, provide account information, request payment, offer restructuring, or pursue remedies allowed by the contract and law.

The line is crossed when collection becomes abusive, deceptive, threatening, or publicly humiliating.

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by lending and financing companies. Examples include:

Threatening violence or another criminal act against you, your family, your reputation, or your property;
Threatening an action that cannot legally be taken;
Using insults, obscenities, or abusive language;
Making false or deceptive representations, including pretending to be a court, police officer, lawyer, or government agency;
Falsely claiming that arrest, imprisonment, asset seizure, or another official action is imminent;
Publishing or threatening to publish your name, photograph, debt, or supposed “criminal” status to shame you;
Disclosing or communicating your debt information to unauthorized third parties; and
Contacting people in your phone list who are not guarantors or co-makers to pressure or embarrass you.

The lender cannot avoid responsibility simply by outsourcing collection. The Financial Products and Services Consumer Protection Act, Republic Act No. 11765 prohibits abusive debt-recovery practices and makes a financial service provider responsible for acts or omissions of its representatives. It may also be solidarily liable with an accredited third-party service provider involved in debt collection.

Public shaming and contact-list harassment

Your loan does not give a lender unlimited authority over the contents of your phone.

Under the Data Privacy Act and the NPC’s rules for loan-related transactions, processing must be transparent, for a legitimate purpose, and proportionate to that purpose. An app cannot treat a broad consent clause as permission to harvest, store, message, or shame everyone in your contact list.

The current rules make important distinctions:

An app may request limited access that is genuinely necessary for a lawful loan-processing purpose.
Limited processing may be allowed so that you can select a character reference or guarantor.
Unrestrained or excessive processing of an entire contact list is prohibited.
Contact-list processing that leads to harassment, debt collection from people other than the borrower’s chosen guarantors, or another unfair collection practice is prohibited.
A borrower’s photograph obtained for identity verification, fraud prevention, or payment verification cannot be used to harass or embarrass the borrower.
Once access is no longer supported by a lawful and necessary purpose, the app should disable it or inform the user that the permission may be revoked.

These requirements appear in NPC Circular No. 2020-01 and its amendments under NPC Circular No. 2022-02. The NPC has also expressly warned that online lenders may not harvest borrowers’ phone or social-media contacts for harassment and shaming.

A character reference is not automatically responsible for the loan. Under Article 2055 of the Civil Code, a guaranty is not presumed; it must be express and cannot extend beyond what was stipulated. Liability may be different if the person actually signed or validly accepted an agreement as guarantor, surety, co-maker, or co-borrower. The documents—not the collector’s label—control.

Can you be arrested for failing to pay an online loan?

Not for nonpayment of an ordinary debt alone. Article III, Section 20 of the 1987 Constitution states that no person shall be imprisoned for debt.

A creditor may, however, bring a civil collection case. Do not ignore an authentic summons, court order, or notice from a sheriff. Verify it directly with the named court using official contact details—not a phone number supplied only by the collector.

The constitutional protection does not immunize a person from a separate criminal accusation supported by facts, such as alleged fraud, falsification, or issuance of a worthless check under an applicable law. Whether any offense exists depends on the evidence and its legal elements. A collector’s message saying “may warrant ka na” or “ipapaaresto ka today” does not itself prove that a criminal case, warrant, or court order exists.

What to do immediately

1. Preserve evidence before changing the app or phone

Save evidence in its original form whenever possible:

Full screenshots showing the sender, date, time, number, account name, and complete message thread;
Screen recordings of disappearing messages, app notices, posts, or group chats;
Voicemails and lawful recordings already available on your device;
Call logs and the numbers used;
URLs, profile names, account identifiers, and screenshots of public posts;
Messages sent to relatives, coworkers, employers, references, or other contacts;
Written statements from recipients describing what they received and when;
The lender’s app-store page, developer name, privacy notice, permissions, and loan terms;
Loan agreement, disclosure statement, repayment schedule, receipts, transaction records, and payment instructions;
Your written complaint to the lender and proof it was received; and
Any police blotter, platform report, takedown request, or regulator acknowledgment.

Keep an untouched copy. Back it up somewhere the lending app cannot access. Avoid cropping away identifying details, and do not edit the original files. If a witness is willing, ask the person to retain the original message rather than forwarding only a screenshot.

2. Secure the device

After preserving the evidence:

Revoke the app’s access to contacts, photos, camera, microphone, location, call logs, SMS, and storage unless access remains genuinely necessary;
Review permissions under your phone’s privacy settings;
Change passwords for email, social media, cloud storage, and financial accounts if you suspect compromise;
Enable multi-factor authentication;
Check whether unfamiliar device administrators, accessibility services, profiles, or apps were installed;
Report abusive posts or accounts to the relevant platform; and
Uninstall the lending app if you no longer need it and have already saved the necessary records.

Revoking access may prevent future collection from your device, but it cannot retrieve data that the company already copied. A written objection and deletion request may therefore still be necessary.

3. Send a written stop-harassment and privacy notice

Send the notice to the lender’s official customer-assistance channel, privacy officer, or data protection officer. Keep proof of delivery.

A concise notice may say:

I dispute and object to threats, abusive communications, public shaming, and disclosure of my loan or personal data to unauthorized third parties. Stop contacting persons who are not valid guarantors or co-makers and stop using my photograph, contacts, or other personal data for harassment. Preserve all records relating to my account and collection activity. Please provide the legal company name, SEC or regulatory details, name of the authorized collection agency, complete account statement, and official channel for written communication. I remain willing to address any verified lawful obligation without waiving my rights.

If relevant, identify specific recipients, phone numbers, posts, and dates. Do not include unnecessary sensitive information. Do not send passwords, one-time PINs, card security codes, or identity documents through an unverified account.

For an NPC complaint, the general rule is that you must first inform the respondent in writing of the privacy violation and give it an opportunity to act. If it takes no timely or appropriate action, or gives no response within 15 calendar days from receipt, you may proceed with the complaint and attach proof of this prior notice. The NPC may waive exhaustion in circumstances allowed by its rules, but do not assume an exception without checking your facts.

4. Verify the lender and the claimed balance

Ask for:

The corporation’s complete legal name;
SEC registration and Certificate of Authority details, if it is a lending or financing company;
The registered online lending platform name;
The collection agency’s authority;
The signed or electronically accepted loan agreement;
The disclosure statement;
An itemized computation of principal, interest, fees, penalties, payments, and remaining balance; and
An official payment channel and receipt.

A certificate of incorporation alone does not necessarily authorize a company to operate as a lending or financing company. Verify the company and platform through current SEC records or ask the SEC directly.

Do not pay a collector’s personal e-wallet or bank account merely to stop threats. Confirm payment instructions through a separately verified official channel.

Where to file a complaint

More than one route may apply because the same conduct can involve lending regulation, privacy rights, and possible crimes.

Securities and Exchange Commission

Use the SEC route when the respondent is a lending company, financing company, online lending platform, or its collection agent and the issue includes unfair collection, lack of disclosure, unauthorized lending activity, or another violation within SEC jurisdiction.

The SEC instructs complainants to:

Complete its complaint form accurately;
File one complaint form per respondent company;
Attach a valid government-issued ID; and
Include supporting records such as the disclosure statement, repayment schedule, receipts, promissory note, messages, and other relevant evidence.

Check the SEC’s current complaint instructions for lending and financing companies and use SEC iMessage for the current electronic inquiry or complaint route.

The SEC can investigate regulatory violations, but its complaint unit does not simply rewrite your contract, cancel the debt, declare the loan void, or settle the account for you.

National Privacy Commission

Complain to the NPC when the conduct involves:

Contact-list harvesting or messaging;
Disclosure of the debt to relatives, coworkers, employers, or the public;
Use of your photograph or ID for shaming;
Excessive app permissions;
Refusal to explain how your data was obtained or used;
Failure to act on a valid access, correction, objection, blocking, or erasure request; or
Another unauthorized or disproportionate use of personal data.

Follow the NPC’s current mechanics for complaints. Ordinarily, submit a filled-out and notarized Complaint-Assisted Form or a verified complaint, supporting evidence, and witness affidavits. Filing may be made personally, by registered mail, by courier, or through electronic mail when authorized by the NPC. Follow the current form and filing instructions exactly; insufficient form or evidence may lead to dismissal.

Possible liability depends on the proven act. The Data Privacy Act, Republic Act No. 10173 separately addresses conduct such as unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure. Not every rude collection message automatically establishes every Data Privacy Act offense.

Bangko Sentral ng Pilipinas

Use the BSP route if the lender or financial service provider is supervised by the BSP, such as a bank or another BSP-supervised institution. First complain through the institution’s own Financial Consumer Protection Assistance Mechanism. If unresolved or the institution does not act, escalate through the BSP Consumer Assistance Mechanism.

The BSP accepts complaints through its official website’s BOB webchat and other channels listed in its consumer-redress guidance under Circular No. 1169. BSP Circular No. 1160 likewise requires supervised institutions and their collection agents to use good faith, reasonable conduct, and legally permissible collection methods.

Police and cybercrime authorities

Seek police help promptly if messages contain credible threats of physical harm, stalking, extortion, identity theft, account intrusion, impersonation, or another apparent crime. If danger is immediate, call 911 or go to the nearest police station.

Online threats may potentially implicate provisions on threats, coercion, libel, or other offenses, depending on the exact words, surrounding acts, intent, publication, and evidence. The use of a computer system can also affect the applicable law. Criminal classification should be left to investigators and prosecutors rather than assumed from a single screenshot.

Cybercrime incidents may also be referred through the Department of Justice Office of Cybercrime’s official reporting page. Bring original files, device information, account identifiers, URLs, and a clear timeline.

Dealing with the debt separately

Stopping abuse and resolving the loan are related but distinct issues.

If the debt appears valid:

Ask for a written, itemized statement;
Compare it with the contract, disclosure statement, payments, and receipts;
State which amounts you accept or dispute;
Propose only a payment plan you can realistically maintain;
Require written confirmation of any restructuring, waiver, settlement, or final payoff;
Pay only through a verified official channel; and
Obtain and preserve every receipt and, after full settlement, written confirmation that the account is closed.

Do not admit an amount you have not verified. Avoid making a rushed “token payment” solely because a collector claims it will prevent arrest. A payment or written acknowledgment can have legal consequences that depend on the documents and timing.

If you receive genuine court papers, read the deadline immediately and obtain legal help. A regulator complaint usually does not suspend a court deadline.

Common mistakes to avoid

Deleting messages too early. Preserve them first.
Posting unredacted screenshots publicly. You may expose your own ID, address, account number, relatives, or private messages and create additional legal issues.
Threatening the collector back. Keep communications factual and written.
Assuming the debt disappears because collection was abusive. The underlying obligation requires a separate assessment.
Paying an unverified personal account. Confirm the payee independently.
Sending one vague complaint to every agency. Identify each respondent, act, date, affected person, and requested remedy.
Skipping the lender’s written complaint channel. Prior written notice is important, especially for NPC and BSP procedures.
Calling every contact a guarantor. A reference is not automatically a guarantor; examine the actual agreement.
Ignoring a real summons because collectors previously sent fake threats. Verify the case directly with the court.
Assuming consent permits everything. Consent does not excuse processing that is excessive, unlawful, or used for harassment.

When legal help is urgent

Consult a lawyer, the Public Attorney’s Office if you qualify, or another recognized legal-aid provider promptly when:

A threat identifies your home, workplace, children, or planned physical action;
Intimate images, altered photographs, IDs, or sensitive records are being circulated;
Your employer, customers, or business contacts are being repeatedly contacted;
Money is demanded in exchange for not publishing information;
An account was opened or a loan was taken using your identity;
You received authentic court papers, a subpoena, or notice from law enforcement;
A collector entered your home or workplace, damaged property, or physically confronted you;
Several companies or collectors are involved and their identities are unclear; or
The harassment has caused serious financial, employment, health, or safety consequences.

A lawyer can assess possible civil damages, injunctions, criminal complaints, regulatory remedies, and defenses to collection based on the actual documents and evidence.

Frequently asked questions

Is it legal for a lender to message my family or employer?

Usually not merely to pressure or shame you. Disclosure of your debt or personal data to unauthorized third parties may violate SEC collection rules and data-privacy requirements. A different analysis may apply to a person who is a valid guarantor, surety, co-maker, or authorized representative, or where disclosure is otherwise specifically required or permitted by law.

Can the lender post my photograph and label me a scammer?

Using a borrower’s photograph to harass or embarrass the borrower in collecting a delinquent loan is prohibited under NPC loan-processing rules. A public accusation may also raise privacy, defamation, or other legal issues depending on its content, truth, audience, and circumstances.

Can collectors call everyone in my contact list because I accepted the app permissions?

No. App permission is not unlimited authority. Unbridled or excessive processing of contact lists—especially processing that causes harassment or collects from people other than the borrower’s selected guarantors—is prohibited.

Can my reference be forced to pay?

Not merely because the person was listed as a reference. A guaranty is not presumed and must be express. Review whether that person actually agreed in writing or through a legally effective electronic process to become a guarantor, surety, co-maker, or co-borrower.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers, but keep at least one secure written channel open if practical for formal notices, account verification, and settlement discussions. Blocking a number does not stop the lender from filing a lawful civil case.

Does filing with the SEC or NPC suspend payment?

Not automatically. A regulatory or privacy complaint does not by itself cancel the loan, halt contractual accruals, or extend a court deadline. Request any payment accommodation or disputed-balance treatment in writing.

What if the lender is unregistered?

Do not assume that being unregistered automatically eliminates every possible obligation. Preserve the contract and payment records, stop sending money through unverified channels, and report the operator to the SEC. Obtain legal advice about the enforceability of the agreement and any amounts claimed.

What if the collector says a case has already been filed?

Ask for the complete court name, branch, case number, parties, filing date, and a copy of the pleading. Verify the information independently with the court. A genuine case is communicated through lawful court process—not proved by a threatening text or fabricated “warrant.”

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights, deadlines, jurisdiction, and available remedies depend on the lender’s regulatory status, the contract, the communications, and other evidence. Official sources and procedures were last checked on 5 September 2026.