How to Report Online Lending App Harassment and Privacy Violations

Quick answer

If an online lending app is threatening you, publicly shaming you, contacting people in your phone who are not guarantors, misusing your photos or contacts, or using your personal data beyond what is necessary for the loan, you can report the conduct to the appropriate Philippine authorities.

For unfair debt-collection practices, report the lending or financing company to the Securities and Exchange Commission (SEC), Financing and Lending Companies Department (FINLEND) through the SEC iMessage system. For unauthorized or excessive processing of personal data, a complaint may be filed with the National Privacy Commission (NPC). Threats, fraud, scams, extortion, impersonation, or other possible cybercrimes may also be reported to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. In an immediate physical emergency, call 911.

The fact that a borrower owes money does not give a lender or collector unlimited authority to intimidate the borrower or use the borrower's personal data however it wishes. At the same time, reporting harassment or a privacy violation does not automatically cancel a valid loan or erase the unpaid balance. The legality and amount of the debt, and the legality of the collection methods, are separate questions. (SEC Appointment System)

What online lending practices can be reported?

Philippine rules prohibit or restrict several collection practices commonly associated with abusive online lending apps.

Threats, intimidation, and abusive messages

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing and lending companies, including their third-party collection providers, from using or threatening violence or other criminal means to harm a borrower, the borrower's reputation, or property. It also prohibits threats to take actions that cannot legally be taken, as well as obscenities, insults, or profane language whose natural consequence is abuse or a criminal offense.

Examples that should be documented and reported may include:

• threats to physically harm you or another person;
• threats to destroy property or damage your reputation;
• abusive, degrading, obscene, or profane messages;
• threats of supposedly automatic arrest, imprisonment, or other legal consequences that the collector has no lawful power to impose;
• false representations about who the collector is or what legal action has already been taken; or
• deceptive methods used to pressure you into paying.

A lender may pursue lawful collection remedies. The problem is not the mere act of demanding payment; it is the use of prohibited or unlawful methods.

Public shaming and disclosure of a borrower's information

SEC rules generally prohibit the disclosure or publication of borrowers' names and other personal information for the purpose of shaming or coercing them into payment, subject to limited lawful disclosures recognized by the rules. Those exceptions may include disclosures made with proper consent, disclosures required by a court or authorized government agency, certain credit-information exchanges, and disclosures to legitimate service providers involved in administering or collecting the account.

Posting a borrower's photograph on social media with accusations such as "scammer," circulating a debt notice to unrelated people, or broadcasting a person's indebtedness merely to embarrass or pressure the borrower may therefore raise both unfair-collection and data-privacy issues, depending on the facts.

Contacting people stored in your phone

Current government guidance is particularly clear on this point. The March 18, 2026 Joint Advisory of the DICT, NPC, and SEC states that, for debt collection, an online lending platform is prohibited from contacting persons in a borrower's contact list other than the guarantor. A character reference is not automatically a guarantor. A guarantor must have expressly undertaken the guaranty and must separately consent to the processing of personal data for that purpose.

This means that simply giving an app access to your contacts does not give the lender a blanket right to message your relatives, friends, officemates, employer, clients, or other stored contacts to pressure you into paying.

There can be important factual distinctions. For example, an actual guarantor may lawfully be contacted in connection with the guaranty. A person's status as a guarantor should therefore be determined from the documents and consent actually given—not merely from the lender's description of that person as a "reference."

Excessive access to contacts, photos, or other phone data

The 2026 Joint Advisory prohibits unnecessary app permissions and unauthorized, excessive, or disproportionate processing of personal data. It specifically addresses access to contact lists and other device permissions by online lending platforms.

An online lender may process information genuinely necessary for a specified and lawful purpose, such as identity verification, subject to applicable privacy requirements. But access cannot be unrestrained simply because the borrower clicked an "Allow" button. The government advisory warns that deceptive interface designs may undermine valid consent and states that permissions should be limited to what is necessary for the stated purpose. Once the purpose for a permission has been accomplished, the user should be prompted to turn off, disallow, or revoke that permission.

Consent is therefore not a blank check for a lender to harvest a borrower's entire phone and later use the information for harassment.

Calls or messages at unreasonable hours

Under SEC Memorandum Circular No. 18, collection communications made before 6:00 a.m. or after 10:00 p.m. are generally considered unreasonable or inconvenient. The circular recognizes exceptions where the account has been past due for more than 15 days or where the borrower expressly agreed—in writing, electronically, or through a recorded medium—that those hours are the only reasonable or convenient times for contact.

That exception does not authorize threats, public shaming, unlawful disclosures, or other prohibited conduct.

Preserve evidence before blocking, uninstalling, or deleting anything

A strong complaint is easier to evaluate when it identifies the lender, the collector, what happened, when it happened, and the evidence supporting each allegation.

Before deleting the lending app or wiping messages, preserve as much of the following as is reasonably available:

• screenshots of threatening, insulting, or deceptive texts, chats, emails, and in-app messages;
• screenshots showing the date, time, sender's number or account, and complete conversation where possible;
• call logs and any lawfully obtained voicemail or recordings already in your possession;
• screenshots or screen recordings of public-shaming posts before they disappear;
• copies of messages sent to relatives, friends, coworkers, employers, or other third parties;
• names and short written accounts from people whom the collector contacted;
• the app's name, developer or publisher, download page, website, and the corporate name of the lender if shown;
• your loan agreement, disclosure statement, repayment schedule, payment receipts, and account history;
• screenshots of the app's requested permissions;
• the privacy notice, consent screens, terms and conditions, or other disclosures you were shown when applying;
• screenshots showing access to contacts, photographs, camera, location, or other data that appears unrelated or excessive;
• the collector's name or claimed identity;
• telephone numbers, email addresses, social-media accounts, and payment accounts used by the collector; and
• your written complaint to the lender or app operator and proof showing when it was received.

Save copies somewhere the lending app cannot access—for example, a secure device or account under your control. If documents contain IDs, account numbers, addresses, children's information, or other sensitive information, do not post them publicly merely to prove that harassment occurred.

After preserving the evidence you need, review the app's permissions and revoke permissions that are no longer necessary. The 2026 Joint Advisory itself directs online lending platforms toward purpose-limited permissions and revocation once the relevant purpose has been fulfilled.

Step 1: Identify the actual lender or financing company

Do not rely only on the lending app's brand name. Determine, if possible, the corporate entity actually extending the loan.

Check the loan agreement, disclosure statement, privacy notice, app listing, receipts, SMS messages, and payment instructions for the company's full name. You can then check the SEC's current information on financing and lending companies and recorded online lending platforms.

The SEC continues to publish advisories concerning unauthorized online lending platforms. It also issued SEC Memorandum Circular No. 20, Series of 2026, dated July 7, 2026, containing updated prudential, disclosure, and market-conduct requirements for financing and lending companies and lifting the previous moratorium on online lending platforms. (Securities and Exchange Commission)

If you cannot identify the company, preserve everything you have—the app name, website, telephone numbers, payment accounts, screenshots, and app-store information—and state in your report that the true operator remains unidentified.

Step 2: For a privacy complaint, first notify the lender or data controller in writing

Under the NPC's 2021 Rules of Procedure, a complainant generally must first give the personal information controller, personal information processor, or other concerned entity an opportunity to address the alleged privacy violation.

The notice should be in writing. As a general rule, an NPC complaint may proceed when the entity fails to take timely and appropriate action or fails to respond within 15 calendar days from receipt of the written notice. The NPC may dispense with this requirement for good cause, including serious violations where immediate Commission action may be necessary to prevent or mitigate grave or irreparable harm or where another adequate remedy is unavailable.

Your written notice can identify:

• your name and account, without unnecessarily sending additional sensitive information;
• the lending app and corporate operator;
• the specific conduct you object to;
• the dates of the incidents;
• the personal data involved;
• the people who were contacted, if relevant;
• the permissions or data you believe were improperly accessed;
• the action you want stopped;
• a request that relevant records and logs be preserved; and
• a request for a written response.

Keep proof that the notice was actually sent and received. This correspondence may later be required as part of the NPC complaint.

If the conduct involves an immediate threat, ongoing extortion, account compromise, or another urgent danger, do not delay contacting law enforcement merely because a privacy complaint is also being prepared.

Step 3: Report unfair debt collection to the SEC

The March 18, 2026 Joint Advisory directs complaints concerning unfair debt-collection practices to the SEC's Financing and Lending Companies Department through the SEC iMessage system. It also identifies the SEC assistance hotline as 1-4732 (1-4SEC).

When preparing the complaint, organize the facts chronologically:

1. Identify the lending or financing company and the app involved.
2. State when the loan was obtained and, if relevant, when it became due.
3. Describe each allegedly abusive collection incident with dates and times.
4. Identify the collector, number, account, or profile when known.
5. Explain which third parties were contacted and whether any of them actually agreed to be guarantors.
6. Attach screenshots, loan documents, proof of payment, call logs, and other relevant evidence.
7. Distinguish the collection misconduct from any separate dispute about the amount of the loan.

The SEC's complaint guidance stresses the importance of accurate information and supporting evidence and instructs complainants to use a separate complaint form for each respondent company. (SEC Appointment System)

The SEC can investigate conduct within its regulatory authority, but filing a complaint should not be treated as a method of automatically cancelling a debt. The SEC itself cautions that its complaint process does not by itself rewrite loan terms, declare a loan contract void, or settle a borrower's obligation. (SEC Appointment System)

Step 4: File a formal privacy complaint with the NPC when appropriate

If the issue involves unauthorized access to contacts, excessive phone permissions, disclosure of personal information, public shaming using personal data, or another violation of data-privacy rights, the NPC is the primary privacy regulator.

The NPC currently requires a formal complaint to be made through a properly completed and notarized Complaints-Assisted Form or another verified complaint satisfying its procedural requirements, together with supporting evidence. Current NPC guidance allows filing personally, by registered mail, by courier, or by electronic mail as authorized by the Commission; electronic documents are subject to the NPC's requirements for electronic filing. (Privacy Commission)

A formal complaint should generally:

• be in writing, signed, and verified;
• identify the complainant and respondent, or explain the circumstances that may allow the respondent to be identified;
• clearly state the material facts;
• attach available evidence;
• state the relief requested;
• attach the complainant's prior written correspondence with the respondent and any response;
• include supporting documents and witness affidavits when applicable; and
• contain the required certification against forum shopping. (Privacy Commission)

If you later learn that the same or a similar action has been filed before another court, tribunal, or quasi-judicial agency, the NPC rules require the fact to be reported to the Commission within five calendar days. (Privacy Commission)

The NPC's current Complaints-Assisted Form also reminds complainants to attach supporting proof, provide a valid government-issued ID, and submit one complaint form per respondent. Filing fees apply under the NPC's current schedule unless an exemption or waiver applies, so check the latest form and fee instructions before submission rather than relying on an old copy downloaded elsewhere. (Privacy Commission)

The NPC currently lists complaints@privacy.gov.ph for complaint concerns and publishes updated complaint procedures and forms on its official website. (Privacy Commission)

Step 5: Report threats, scams, fraud, or possible cybercrime

Some online lending incidents go beyond regulatory violations and may involve possible criminal conduct. The March 2026 Joint Advisory directs victims of other forms of harassment, threats, fraud, or scams to the following government cybercrime channels:

• DICT Cyber Hotline: 1326@dict.gov.ph
• NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
• PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; telephone (632) 8723-0401 local 7491

Examples warranting prompt law-enforcement attention can include credible threats of physical violence, extortion or blackmail, impersonation of police or government officials, fraudulent documents, account takeover, identity theft, or threats accompanied by disclosure of your home or workplace information.

For an immediate emergency or imminent threat to someone's safety, the government's nationwide emergency number is 911. (Philippine Information Agency)

Do not assume every aggressive message automatically constitutes a particular criminal offense. Criminal liability depends on the exact words, acts, intent, evidence, and elements of the offense. Preserve the original evidence and let the proper authorities assess it.

What if a collector says your contacts consented because you listed them as references?

Being listed as a character reference is not the same thing as becoming a guarantor.

The 2026 Joint Advisory states that information concerning character references should be used only for identification or verification purposes consistent with the applicable rules. Character references should be informed that they have been selected and how their information was obtained. A guarantor, by contrast, must expressly undertake the guaranty, and separate consent is required for the corresponding processing of personal information.

Accordingly, a lender should not transform every reference, friend, relative, or telephone contact into a collection target simply because the borrower installed an app or gave access to a contact list.

What if you originally gave the app permission to access your contacts or photos?

Permission does not necessarily make every later use lawful.

The Data Privacy Act requires lawful and appropriate processing of personal information, and the NPC's online-lending rules specifically prohibit unnecessary, excessive, or disproportionate processing. The 2026 Joint Advisory further warns against deceptive design practices that may improperly obtain consent. (Privacy Commission)

For example, limited access genuinely needed to verify identity does not necessarily authorize a lender to copy photographs for public shaming, message dozens of unrelated contacts, or retain information indefinitely for unrelated purposes.

Whether particular processing was lawful can depend on what data was collected, why it was collected, the privacy notice and consent actually shown, whether another lawful basis existed, how long the data was retained, and what the lender later did with it.

Can a collection agency avoid liability by saying it is only a third-party contractor?

Outsourcing collection does not give the financing or lending company a free pass.

SEC Memorandum Circular No. 18 provides that engaging a third-party service provider for debt collection does not absolve the financing or lending company from responsibility. For purposes of the circular, the service provider acts as the company's agent, and the financing or lending company retains ultimate responsibility for compliance with the collection rules. Collectors are also required to disclose their full name and true identity to the borrower.

For privacy violations, the precise responsibility of the lender, app operator, processor, collection agency, officers, or individual collectors depends on their respective roles and conduct under the Data Privacy Act.

If the app appears unauthorized or unregistered

Check whether the company and its online lending platform appear in the SEC's current regulatory information. The SEC has continued issuing public advisories in August 2026 concerning unauthorized online lending platforms, mobile applications, and websites. (Securities and Exchange Commission)

If you cannot verify the operator:

• do not provide additional IDs, passwords, OTPs, contact lists, or unnecessary personal information simply because someone claiming to be a collector requests them;
• preserve the app's name, screenshots, website, payment instructions, phone numbers, bank or e-wallet destination accounts, and correspondence;
• state in your SEC or cybercrime report that you could not confirm the operator's identity or authority; and
• check with the relevant payment provider promptly if you believe an account or transaction has been compromised.

An apparently unauthorized app does not, by itself, answer every question about whether money advanced must be repaid. Do not assume that deleting the app or filing a complaint automatically extinguishes an obligation.

Common mistakes that can weaken a complaint

Deleting the app before preserving evidence

Uninstalling may remove messages, account details, permission screens, loan information, or other evidence. Capture what you need first if it is safe to do so.

Filing only screenshots without explaining the sequence of events

A folder containing hundreds of images can be difficult to understand. Prepare a short chronology connecting each important screenshot to a date, sender, and incident.

Reporting only the app's marketing name

Identify the underlying corporation whenever possible. An app called one thing may be operated by a company with a completely different registered name.

Assuming a complaint cancels the loan

A complaint can address unlawful collection or privacy practices without resolving a separate dispute about the validity or amount of the obligation.

Posting your evidence publicly

Uploading your ID, loan contract, mobile number, home address, payment details, or screenshots containing other people's information to Facebook or another public platform can create additional privacy and security risks. Give evidence directly to the proper authority instead.

Ignoring the NPC's prior-notice requirement

For an ordinary formal privacy complaint, document your written notice to the lender or data controller and proof of receipt. The general rule gives the respondent an opportunity to take appropriate action, with the 15-calendar-day rule discussed above, subject to the NPC's recognized exceptions.

Treating a character reference as automatically liable for the loan

A reference and a guarantor are legally different. Preserve the documents showing exactly what the third person agreed to.

When legal or law-enforcement help becomes urgent

Act promptly when the situation involves a credible threat of violence, extortion, blackmail, publication of intimate or highly sensitive material, identity theft, account takeover, fraudulent use of your ID, widespread disclosure of your home or workplace information, or continuing conduct that may cause serious and difficult-to-reverse harm.

Depending on the circumstances, it may be appropriate to report simultaneously to the SEC, NPC, and cybercrime authorities because one incident can involve several different legal issues.

For severe ongoing privacy harm, the NPC's procedures also recognize applications for a temporary ban on the processing of personal data. Such relief involves procedural requirements and should not be assumed to issue automatically; where the harm is serious or immediate, consider obtaining individualized legal advice on whether emergency relief is appropriate. (Privacy Commission)

Frequently asked questions

Can a lending app contact my family, friends, or employer about my debt?

For collection through a borrower's contact list, current DICT-NPC-SEC guidance prohibits contacting persons other than the borrower's guarantor. A character reference is not automatically a guarantor. Other limited lawful disclosures may exist in circumstances specifically recognized by law or regulation, so the actual relationship and documents still matter.

Can collectors call me after 10:00 p.m.?

SEC Memorandum Circular No. 18 generally treats collection contact before 6:00 a.m. or after 10:00 p.m. as unreasonable or inconvenient, subject to its stated exceptions for accounts more than 15 days past due or a borrower's express agreement that those hours are the only reasonable or convenient times. Other prohibited collection methods remain prohibited.

I clicked "Allow Contacts." Does that mean the lender can message everyone?

No blanket authority follows merely from granting a phone permission. Processing must remain lawful, necessary, proportionate, and tied to legitimate specified purposes. Current government guidance expressly prohibits unbridled contact-list processing and collection contact with contact-list persons other than guarantors.

Do I always have to wait 15 days before going to the NPC?

The general rule is that you first notify the concerned entity in writing and give it an opportunity to address the complaint. Failure to respond within 15 calendar days from receipt is one basis for proceeding. The NPC may waive the prior-notice or waiting requirements for good cause or serious violations under the circumstances specified in its Rules of Procedure.

Does filing an SEC or NPC complaint erase my loan?

No. A regulatory complaint concerning harassment, collection conduct, or personal-data processing does not automatically cancel a valid debt. Questions about whether the debt is valid, how much is legally due, whether interest or charges are enforceable, and whether payments have been properly credited may require a separate legal analysis. (SEC Appointment System)

What if the collector threatens to have me arrested immediately for not paying?

Preserve the exact message. A collector may not lawfully use deceptive representations or threats of action that cannot legally be taken. Whether a particular threat also constitutes a criminal offense depends on the facts. Threats, fraud, and other suspected cybercrime may be reported through the government channels identified in the March 2026 Joint Advisory.

Can I complain even if the lending app is not recorded with the SEC?

Yes. The March 2026 Joint Advisory expressly addresses online lending platforms whether recorded or unrecorded. If the operator appears unauthorized, include that fact and whatever identifying evidence you have when reporting the matter.

Official sources and complaint channels

• SEC iMessage complaint portal — current SEC channel identified in the 2026 Joint Advisory for unfair debt-collection complaints.
• Securities and Exchange Commission — current SEC issuances, notices, and advisories, including online-lending advisories and SEC Memorandum Circular No. 20, Series of 2026.
• 2026 Joint DICT-NPC-SEC Advisory on Online Lending Platforms — current inter-agency guidance on online-lending harassment, app permissions, contact lists, guarantors, and complaint channels.
• National Privacy Commission — File a Complaint — official NPC complaint procedure.
• NPC complaint forms — current Complaints-Assisted Form and related forms.
• NPC contact information — current NPC complaint contact details.
• NPC Implementing Rules and Regulations of the Data Privacy Act — official data-privacy rules and related issuances.
• Philippine government emergency hotlines — official government emergency-hotline directory, including 911.

General-information disclaimer

This article provides general Philippine legal information and is not individualized legal advice. The proper remedy can depend on the loan documents, the identity and regulatory status of the lender, the consent and privacy notices involved, the exact collection communications, the data actually processed or disclosed, and any later regulatory or court issuances. Complaint forms, filing requirements, fees, contact details, and online submission systems can also change.

Law, procedures, and official complaint channels last checked: August 26, 2026.