Quick answer

You may report an online lending app to more than one authority because harassment and misuse of personal data are separate—but often overlapping—violations:

Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission (SEC).
Report unauthorized access, disclosure, or misuse of contacts, photos, IDs, messages, or other personal data to the National Privacy Commission (NPC).
If the lender is a bank, digital bank, e-money issuer, or another institution supervised by the Bangko Sentral, first complain to the institution and then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).
Report threats of violence, extortion, impersonation, stalking, account intrusion, or other possible crimes promptly to the Philippine National Police (PNP) or National Bureau of Investigation (NBI).

A legitimate debt does not give a lender or collector permission to threaten, insult, deceive, publicly shame, or indiscriminately contact people in your phone. Reporting misconduct does not automatically erase a valid loan, however. Continue to dispute incorrect charges in writing and request an updated statement of account.

What conduct may be unlawful?

A lender may send reasonable reminders, make a lawful demand, use an authorized collection agency, negotiate payment, or file a proper collection case. The line is crossed when the method becomes abusive, deceptive, or violates privacy.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices by covered lending and financing companies and their collection service providers include:

Using or threatening violence or another criminal means to harm a person, reputation, or property
Threatening action that cannot legally be taken
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense
Disclosing or publishing the names or personal information of alleged nonpaying borrowers, outside recognized confidentiality exceptions
Communicating false loan information, including failing to say that a debt is disputed when communicating information covered by the rule
Using false representations or deceptive means to collect a debt or obtain information
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower gave express written, electronic, or recorded consent that those hours are the only reasonable times for contact
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, even if the borrower allowed the app to access the contact list

The Financial Products and Services Consumer Protection Act also prohibits financial service providers from using abusive collection or debt-recovery practices. Providers are responsible for acts or omissions of their authorized representatives.

Privacy violations commonly committed by lending apps

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate. A lender must also have a lawful basis for each form of processing.

Potential violations include:

Accessing an entire contact list when that access is unnecessary or excessive
Requiring unrelated permissions to contacts, photos, storage, camera, location, call logs, or messages
Using data collected for identity verification for public shaming or collection pressure
Sending loan information, IDs, photographs, or accusations to relatives, friends, co-workers, clients, or employers
Posting the borrower’s identity or debt on social media or in group chats
Continuing unnecessary access after the relevant loan-processing purpose has ended
Giving personal data to an unauthorized collector or other third party
Refusing to explain what data was collected, why it was used, or to whom it was disclosed
Failing to correct inaccurate data or properly address a lawful data-subject request

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, an online lender may request app permissions only when they are suitable, necessary, and not excessive for a legitimate purpose. Consent should be obtained when the particular data becomes necessary, with a just-in-time notice explaining how it will be processed.

Access to a camera or photo gallery may be justified temporarily for identity verification, fraud prevention, or payment verification. That does not authorize unrestricted access or later use of photographs to embarrass a borrower.

Character references are not guarantors

A character reference may be contacted only to verify the applicant’s identity and the truth of information supplied for the loan application. The lender must tell the reference how the contact details were obtained and provide an option to have the data removed as a character reference.

A lender may not use a character reference’s information for collection, marketing, cross-selling, or unrelated sharing. A character reference is not automatically a guarantor. A guarantor must have separately and expressly agreed to answer for the debt in accordance with applicable law.

Protect yourself before deleting anything

Preserve evidence first. Harassing messages and app information may disappear after you block a number, leave a group chat, uninstall the app, or lose access to an account.

Save the following:

Full screenshots showing the message, sender, date, and time
Screen recordings that show the complete conversation or social-media post
Original emails, text messages, chat exports, and voicemail files
Call logs showing the numbers, dates, times, and frequency of calls
Links, usernames, profile URLs, group-chat names, and account identifiers
Copies of messages received by relatives, employers, references, or other contacts
Written statements from affected contacts and screenshots taken from their own devices
The app’s name, developer, store listing, privacy notice, permissions, and version
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and collector’s claimed identity
Loan agreement, disclosure statement, promissory note, payment schedule, receipts, transfer records, and statement of account
Your written complaint to the lender or its data protection officer, proof of delivery, and any response
A timeline separating the loan transaction, payment history, disputed charges, threats, disclosures, and reports already made

Keep unedited originals. Make backup copies in a secure location. Do not publicly repost unredacted IDs, account numbers, contact lists, or private conversations simply to expose the lender; that can create further privacy and security risks.

After preserving evidence, review and revoke unnecessary app permissions through your phone settings. Change passwords if the app or collector may have obtained account credentials, enable multi-factor authentication, and warn affected contacts not to send money or disclose more information.

Send a written demand to the lender

Unless immediate protection is necessary, write first to the lender’s official consumer-assistance unit and data protection officer. This creates a record and is generally important before escalating a privacy or BSP complaint.

State:

Your name, account or loan reference, and reliable contact details.
The specific acts complained of, with dates and sender information.
Which loan amounts or charges you dispute, if any.
What personal data was accessed, used, or disclosed.
The names or categories of third parties contacted.
That you object to harassment and unauthorized or excessive processing.
The action you want—for example, stop third-party contact, preserve records, identify recipients, correct inaccurate information, restrict unlawful processing, and communicate only through a stated channel.
A reasonable request for a written response and case reference number.

Do not admit an amount you genuinely dispute merely to stop the messages. At the same time, avoid claiming that every collection contact is illegal. Focus on verifiable conduct.

How to file an SEC complaint

Use the SEC route when the respondent is a lending company or financing company, including misconduct by its collection agent.

The SEC’s official complaint instructions require:

A fully completed complaint form
One complaint form for each respondent company
A copy of a valid government-issued ID
Supporting evidence, such as messages, call logs, loan documents, disclosure statements, payment records, and correspondence

You may submit the complaint:

By email to flcd_complaints@sec.gov.ph
Through the filing methods and address stated on the SEC complaint page

For email filing, the SEC directs complainants to use this subject format:

COMPLETE NAME_RESPONDENT COMPANY_SUBJECT OF COMPLAINT

Identify the legal company behind the app, not only the app’s brand name. Its corporate name and authority details should appear in the app or advertising materials. If they are missing, state that fact and attach screenshots.

The SEC sends a copy of the complaint to the respondent for an answer or comment. Its published procedure gives the respondent 10 days from receipt to respond. The SEC may request a reply, close a resolved matter, refer it internally, or commence an administrative action when sufficient grounds exist.

The SEC cannot, through this complaint process, rewrite the loan, declare an interest rate void, cancel the obligation, or settle the debt for you.

How to file an NPC privacy complaint

Use the NPC route when personal data was unlawfully accessed, used, disclosed, retained, or otherwise processed.

First satisfy the exhaustion requirement

Ordinarily, you should first notify the lender, financing company, collection provider, or other responsible entity in writing about the alleged privacy violation. Give it an opportunity to act and keep proof of your notice.

Under the NPC’s current rules, the complaint should show either that:

The respondent did not take appropriate action within 15 calendar days from receipt of your written notice; or
The respondent’s response was inadequate.

The NPC may waive exhaustion for good cause under circumstances recognized by its rules, including situations involving a serious violation, grave and irreparable harm requiring NPC intervention, lack of a plain, speedy, or adequate remedy from the respondent, or patently illegal action. Explain and support any request for waiver rather than merely skipping the requirement.

Prepare and submit the formal complaint

Follow the NPC’s official filing instructions:

Download and complete the prescribed complaint-assisted form.
Attach your evidence and relevant correspondence.
Have the complaint notarized.
Submit it personally, by courier, or as a scanned filing by email to complaints@privacy.gov.ph.
Check the current NPC rules, forms, and schedule of fees before submission.

Describe the data processing precisely: what information was taken, the apparent source, how it was used, who received it, why the use was unnecessary or unauthorized, and what harm resulted. If you are a relative, co-worker, or other contact whose number was obtained and used, explain that you are complaining about the processing of your own personal data.

Possible NPC action depends on the evidence and procedure. The NPC may investigate, order corrective measures, restrict or stop processing, or impose sanctions within its legal authority. Criminal liability under the Data Privacy Act is not automatic; the statutory elements and evidence must be established through the proper process.

When to complain to the BSP

If the app is operated by or on behalf of a BSP-supervised financial institution—such as a bank, digital bank, non-bank electronic-money issuer, pawnshop, or other covered institution—use that institution’s consumer-assistance mechanism first.

If the issue remains unresolved, escalate it through the BSP Consumer Assistance Mechanism:

Use the BSP Online Buddy or BOB through the BSP website.
Alternatively, complete the BSP Complaints, Inquiries and Requests form and email it to consumeraffairs@bsp.gov.ph.
Attach your complaint to the institution, its reply if any, and the supporting documents.

The BSP route is not a substitute for an NPC complaint about privacy or a police report concerning possible crimes. The same incident may properly require separate reports.

When police or NBI help is urgent

Contact law enforcement promptly if the collector:

Threatens physical harm, kidnapping, sexual violence, property damage, or immediate retaliation
Demands money through threats or coercion
Uses or distributes intimate images
Impersonates a police officer, court employee, lawyer, prosecutor, or government agency
Sends a fake warrant, subpoena, court order, or police document
Hacks an account, takes over a profile, or uses stolen credentials
Publishes defamatory accusations or personal information in circumstances that may constitute an offense
Continues stalking or threatening you after being told to stop

If danger is immediate, call 911 or go to the nearest police station. For technology-facilitated conduct, you may also approach the PNP Anti-Cybercrime Group or the NBI Cybercrime Division through their current official channels.

Show the original messages and devices when requested, but retain copies and obtain a report or reference number. Do not pay someone who claims they can stop an arrest or erase a case. Verify any alleged legal document directly with the issuing court or agency using independently obtained contact details.

Common mistakes to avoid

Uninstalling the app before preserving evidence. Save the app identity, permissions, privacy notice, loan records, and messages first.
Naming only the brand. Identify the corporation operating the app and any collection agency involved.
Submitting cropped screenshots without context. Include sender details, dates, times, and surrounding messages.
Filing an NPC complaint without first notifying the respondent. Unless a supported exception applies, this may prevent the complaint from being given due course.
Sending one SEC form against several companies. The SEC requires one complaint form per respondent.
Relying only on phone calls. Follow up in writing and keep delivery records.
Assuming that revoking contact permission deletes data already collected. Request information about prior collection, disclosure, retention, and deletion separately.
Publishing the lender’s messages with unredacted personal information. Preserve evidence privately and submit it to the proper authority.
Ignoring the underlying account. Ask for the contract, disclosure statement, payment history, itemized balance, and official payment channel.
Paying a collector’s personal wallet without verification. Confirm the payee and settlement terms through the lender’s official channel and demand a receipt.
Treating a character reference as a debtor. A reference is not liable merely because the borrower named them.

Practical complaint checklist

Before submitting, confirm that your complaint contains:

The correct respondent’s legal and trade names
The app name and download source
Your loan or account reference
A chronological factual narrative
Exact words or conduct complained of
Dates, times, numbers, usernames, and URLs
Names of contacts who received disclosures
Original or clearly readable supporting evidence
Loan and payment documents
Your prior written notice and proof of receipt
The respondent’s answer, or proof that 15 calendar days passed where relevant to an NPC filing
The specific relief requested
Your signature, valid ID, and notarization where required
Separate submissions to each authority based on its jurisdiction

Keep copies of everything submitted, including attachments, email headers, courier receipts, acknowledgment messages, and reference numbers.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. Under the applicable NPC and SEC rules, using the borrower’s contact list to contact people who were not properly named as guarantors or co-makers is prohibited for debt collection. App permission does not turn every contact into a collection target.

Can the lender contact my character reference about payment?

A character reference is for verifying identity and the truth of application information. The person is not automatically a guarantor and should not be contacted for debt collection merely because they were listed as a reference.

Does reporting harassment cancel my loan?

No. A regulatory or privacy complaint addresses misconduct. It does not automatically invalidate the contract or extinguish a valid balance. Disputes over the amount, interest, contract validity, or payment obligations may require a different proceeding or legal advice.

Can I be jailed simply because I could not repay a loan?

The Philippine Constitution prohibits imprisonment for debt. Mere inability or failure to pay a civil debt is not, by itself, a crime. Separate criminal issues may arise from distinct conduct—such as proven fraud, falsification, or another offense—but a collector cannot lawfully invent criminal liability or a fake arrest threat.

Is calling before 6:00 a.m. or after 10:00 p.m. always prohibited?

The SEC rule generally treats those hours as unreasonable. It recognizes exceptions when the account is more than 15 days past due or the borrower expressly consented, through written, electronic, or recorded means, that those hours are the only reasonable or convenient times for contact. Threats, insults, deception, and unlawful disclosure remain prohibited regardless of the hour.

What if I clicked “Allow contacts”?

Permission is not unlimited authority. The processing must still have a lawful basis, a declared legitimate purpose, and be necessary and proportionate. The NPC’s loan-data rules specifically prohibit contacting persons in the list who were not named as guarantors for debt collection.

May a relative or co-worker file a complaint?

Yes, if their own personal data was obtained or misused, or their privacy rights were violated. They should preserve the messages received on their device and describe how the lender obtained or used their information.

Should I block the collector?

You may block abusive numbers after preserving the evidence. First send any necessary written notice through the lender’s official channel so that your complaint and request are documented. Blocking a number does not prevent the lender from using lawful collection remedies.

What if I cannot identify the company behind the app?

Save the app-store listing, developer details, website, privacy notice, payment recipient, text-message sender, bank or e-wallet transaction records, and all corporate or authority numbers shown. Tell the SEC that the operator’s identity or authority was not properly disclosed and provide everything available.

Do I need a lawyer?

A lawyer is not always required to file an administrative complaint. Seek legal help promptly if you received actual court papers, the disputed amount is substantial, identity theft is involved, intimate material was threatened or distributed, there are credible threats to safety, or you are considering civil or criminal proceedings. The Public Attorney’s Office or a local legal-aid organization may be able to assist if you qualify.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Procedures and conclusions may depend on the lender’s regulatory status, the loan documents, the data collected, and the evidence of each communication. Official sources and filing channels were checked as of September 3, 2026.